PT-2025-38321 · D Link · D-Link Dir-825

Panda_0X1 · CVE-2025-10666 · Published 2025-09-10 · Updated 2026-02-03

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 versions up to 2.10

Description A security flaw exists in D-Link DIR-825 up to version 2.10. The vulnerability is located in the apply.cgi file, specifically within the sub 4106d4 function. Manipulation of the countdown time argument can lead to a buffer overflow, allowing for remote attacks. The exploit for this issue has been publicly released. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-11399

CVE-2025-10666

Affected Products

D-Link Dir-825

References · 15

• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md · Exploit
• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc · Exploit
• 🔥 https://exploit-db.com/exploits/52469 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10666 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10666 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11399 · Security Note
• https://twitter.com/redsecuretech/status/2018662105701122284 · Twitter Post
• https://t.me/cveNotify/150799 · Telegram Post
• https://t.me/cveNotify/135786 · Telegram Post
• https://vuldb.com/?id.324787 · Note
• https://twitter.com/CveFindCom/status/1968671160112972003 · Twitter Post
• https://vuldb.com/?submit.652047 · Note
• https://dlink.com · Note
• https://twitter.com/CVEnew/status/1968923632148594791 · Twitter Post
• https://vuldb.com/?ctiid.324787 · Note