PT-2025-53717 · D Link · D-Link Dwr-M920

Panda_0X1 · Published 2025-12-24 · Updated 2026-01-26 · CVE-2025-15190

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DWR-M920 versions up to 1.1.50

Description A security flaw exists in D-Link DWR-M920. The issue involves a stack-based buffer overflow in the sub 42261C function within the /boafrm/formFilter file. Manipulation of the ip6addr argument can trigger this overflow, and the attack can be launched remotely. The exploit for this issue has been publicly released.

Recommendations Versions prior to 1.1.50 should be updated.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-16475

CVE-2025-15190

Affected Products

D-Link Dwr-M920

References · 13

• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formFilter.md · Exploit
• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formFilter.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15190 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16475 · Security Note
• https://vuldb.com/?submit.723553 · Note
• https://t.me/cveNotify/147222 · Telegram Post
• https://vuldb.com/?ctiid.338575 · Note
• https://twitter.com/DavidMarquet19/status/2015696314445541693 · Twitter Post
• https://t.me/CVEtracker/40836 · Telegram Post
• https://vuldb.com/?id.338575 · Note
• https://t.me/cveNotify/147041 · Telegram Post
• https://dlink.com · Note