CVE-2025-13305
📋 TL;DR
A buffer overflow vulnerability in D-Link routers allows remote attackers to execute arbitrary code by manipulating the 'host' parameter in the traceroute diagnostic form. This affects D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M routers running firmware version 1.01.07. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- D-Link DWR-M920
- D-Link DWR-M921
- D-Link DWR-M960
- D-Link DIR-822K
- D-Link DIR-825M
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and potential lateral movement to connected systems.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or use the device for botnet activities.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network exposure remains.
🎯 Exploit Status
Public exploit code is available, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check D-Link support website regularly for firmware updates. If update becomes available, download from official D-Link site and apply through web interface.
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface
Access router web interface > Security > Remote Management > Disable
Block Access to Vulnerable Endpoint
linuxUse firewall rules to block access to /boafrm/formTracerouteDiagnosticRun
iptables -A INPUT -p tcp --dport 80 -m string --string "/boafrm/formTracerouteDiagnosticRun" --algo bm -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for exploitation attempts and unusual traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login > Status > Firmware Version. If version is 1.01.07, device is vulnerable.Check Version:
curl -s http://router-ip/status.cgi | grep firmware_versionVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.01.07📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /boafrm/formTracerouteDiagnosticRun with long host parameters
- Unusual process execution or memory errors in system logs
Network Indicators:
- HTTP requests with abnormally long host parameter values
- Traffic to router management interface from unexpected sources
SIEM Query:
source="router_logs" AND uri="/boafrm/formTracerouteDiagnosticRun" AND host_parameter_length>100🔗 References
- https://github.com/LX-LX88/cve/issues/12
- https://vuldb.com/?ctiid.332645
- https://vuldb.com/?id.332645
- https://vuldb.com/?submit.691809
- https://vuldb.com/?submit.691816
- https://vuldb.com/?submit.693784
- https://vuldb.com/?submit.693806
- https://vuldb.com/?submit.695424
- https://www.dlink.com/
- https://github.com/LX-LX88/cve/issues/12
