CVE-2025-13305: fallo de gravedad alta en D-Link DWR-M920
D-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 3.9%
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
D-Link · DIR-822KD-Link · DIR-825MD-Link · DWR-M920D-Link · DWR-M921D-Link · DWR-M960CVEs relacionadas — D-Link DWR-M920
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-13306MEDIUMD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionEPSS 8.3%CVE-2026-10878MEDIUMD-Link DWR-M920 formSmsManage sub_41C8E8 command injectionEPSS 4.7%CVE-2026-82595MEDIUMD-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injectionEPSS 4.4%CVE-2025-15192MEDIUMD-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injectionEPSS 4.1%CVE-2025-15191MEDIUMD-Link DWR-M920 formLtefotaUpgradeFibocom sub_4155B4 command injectionEPSS 4.1%CVE-2026-11339MEDIUMD-Link DWR-M920 formUSSDSetup sub_41CF20 command injectionEPSS 3.4%