A critical stack-based buffer overflow vulnerability in the D-Link DIR-825 Rev.B 2.10 router firmware allows unauthenticated, zero-click remote attackers to crash the device’s HTTP server. This flaw resides in the router’s httpd binary and stems from improper handling of the language parameter in the switch_language.cgi endpoint. Exploitation requires no valid credentials or user interaction, meaning an adversary only needs network access to the target device’s management interface to trigger a denial-of-service condition. This vulnerability disrupts VPNs, guest Wi-Fi, and IoT device management, leading to potential service outages and loss of network functionality.
Source: https://cybersecuritynews.com/d-link-0-click-vulnerability/
TPRM report: https://scoringcyber.rankiteo.com/company/dlink-corp
"id": "dli331071125",
"linkid": "dlink-corp",
"type": "Vulnerability",
"date": "7/2025",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'industry': 'Networking Equipment',
'name': 'D-Link',
'type': 'Company'}],
'attack_vector': 'Unauthenticated, zero-click remote attack',
'description': 'A critical stack-based buffer overflow in the D-Link DIR-825 '
'Rev.B 2.10 router firmware allows unauthenticated, zero-click '
'remote attackers to crash the device’s HTTP server. The flaw '
'resides in the router’s httpd binary and stems from improper '
'handling of the language parameter in the switch_language.cgi '
'endpoint.',
'impact': {'operational_impact': 'Disrupts VPNs, guest Wi-Fi, and IoT device '
'management',
'systems_affected': 'D-Link DIR-825 Rev.B 2.10 router firmware'},
'initial_access_broker': {'entry_point': 'switch_language.cgi endpoint'},
'lessons_learned': 'Enforce strict input validation, ensure proper bounds '
'checking, monitor for anomalous HTTP POST requests',
'motivation': 'Denial-of-Service (DoS)',
'post_incident_analysis': {'corrective_actions': 'Apply firmware update, '
'limit web-UI access, flag '
'unusually long language '
'posts',
'root_causes': 'Improper handling of the language '
'parameter in the '
'switch_language.cgi endpoint'},
'recommendations': 'Apply firmware update, limit web-UI access, flag '
'unusually long language posts',
'references': [{'source': 'Security Researcher iC0rner'}],
'response': {'remediation_measures': 'Apply firmware update, limit web-UI '
'access, flag unusually long language '
'posts'},
'title': 'Critical Stack-Based Buffer Overflow in D-Link DIR-825 Rev.B 2.10 '
'Firmware',
'type': 'Vulnerability',
'vulnerability_exploited': 'CVE-2025-7206'}