PT-2025-47230 · D Link · Dir-822+3

Lx-Lx · Published 2025-11-09 · Updated 2025-11-18 · CVE-2025-13306

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DWR-M920 version 1.1.5 D-Link DWR-M921 version 1.1.5 D-Link DIR-822K version 1.1.5 D-Link DIR-825M version 1.1.5

Description A security issue exists in D-Link devices that allows for command injection. The system function within the /boafrm/formDebugDiagnosticRun file is affected. Manipulation of the host argument can lead to unauthorized command execution. The exploit for this issue has been publicly disclosed.

Recommendations Update D-Link DWR-M920 to a newer version. Update D-Link DWR-M921 to a newer version. Update D-Link DIR-822K to a newer version. Update D-Link DIR-825M to a newer version.

Exploit

Fix

Special Elements Injection

OS Command Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-78

CWE-77

Related Identifiers

BDU:2025-14543

CVE-2025-13306

Affected Products

Dir-822

Dir-825

Dwr-M920

Dwr-M921

References · 18

• 🔥 https://github.com/QIU-DIE/CVE/issues/39 · Exploit
• 🔥 https://github.com/QIU-DIE/CVE/issues/41 · Exploit
• 🔥 https://github.com/QIU-DIE/CVE/issues/37 · Exploit
• 🔥 https://github.com/LX-LX88/cve/issues/15 · Exploit
• https://bdu.fstec.ru/vul/2025-14543 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13306 · Security Note
• https://vuldb.com/?submit.693805 · Note
• https://twitter.com/VulmonFeeds/status/1990590351069925623 · Twitter Post
• https://vuldb.com/?submit.695426 · Note
• https://dlink.com · Note
• https://vuldb.com/?submit.691813 · Note
• https://vuldb.com/?submit.693807 · Note
• https://t.me/CVEtracker/37566 · Telegram Post
• https://t.me/cveNotify/143125 · Telegram Post