CVE-2025-22968
📋 TL;DR
This critical vulnerability in D-Link DWR-M972V routers allows remote attackers to execute arbitrary code with root privileges via SSH without authentication. Anyone using the affected router version is vulnerable to complete device takeover.
💻 Affected Systems
- D-Link DWR-M972V
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the device for botnet activities.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and use as a proxy for malicious activities.
If Mitigated
Limited impact if SSH is disabled and device is not internet-facing, though local network attacks remain possible.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires only SSH access to the device with root credentials that appear to be hardcoded or unrestricted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Instructions:
No official patch available. Monitor D-Link security bulletin for updates. Consider replacing affected devices if no patch becomes available.
🔧 Temporary Workarounds
Disable SSH Service
allCompletely disable SSH access to prevent exploitation
Check router admin interface for SSH settings and disable
If possible via CLI: systemctl disable sshd
Network Segmentation
allIsolate router from internet and restrict internal access
Configure firewall to block SSH port 22 inbound/outbound
Implement VLAN segmentation
🧯 If You Can't Patch
- Immediately disable SSH service through router administration interface
- Replace affected device with a different model or from different vendor
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.05SSG, device is vulnerable.Check Version:
Check via router web interface at http://router-ip or via serial console if availableVerify Fix Applied:
No official fix available. Verify SSH is disabled by attempting SSH connection to router (ssh root@router-ip). Connection should fail.📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts to root account
- Successful SSH login as root from unexpected sources
- Unusual process execution on router
Network Indicators:
- SSH connections to router from external IPs
- Unusual outbound traffic from router
- DNS queries to malicious domains from router
SIEM Query:
source="router_logs" (event="ssh" AND user="root") OR (event="authentication" AND result="success" AND user="root")