CVE-2025-13305highCWE-119CWE-120

CVE-2025-13305: high-severity vulnerability in D-Link DWR-M920

D-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow

Published · Updated

Follow this CVE+ Monitor DWR-M960+ Monitor DWR-M920

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 3.9%
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
D-Link · DIR-822KD-Link · DIR-825MD-Link · DWR-M920D-Link · DWR-M921D-Link · DWR-M960
Related CVEs — D-Link DWR-M920

In the same product, most dangerous first.

CVE-2025-13306MEDIUMD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionEPSS 8.3%CVE-2026-10878MEDIUMD-Link DWR-M920 formSmsManage sub_41C8E8 command injectionEPSS 4.7%CVE-2026-82595MEDIUMD-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injectionEPSS 4.4%CVE-2025-15192MEDIUMD-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injectionEPSS 4.1%CVE-2025-15191MEDIUMD-Link DWR-M920 formLtefotaUpgradeFibocom sub_4155B4 command injectionEPSS 4.1%CVE-2026-11339MEDIUMD-Link DWR-M920 formUSSDSetup sub_41CF20 command injectionEPSS 3.4%