CVE-2025-3785
📋 TL;DR
This critical vulnerability in D-Link DWR-M961 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the authorization interface. Attackers can exploit this by manipulating the Hostname parameter in the formStaticDHCP endpoint. All users running version 1.1.36 or earlier are affected.
💻 Affected Systems
- D-Link DWR-M961
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Device takeover enabling traffic interception, credential theft, and use as attack platform for further network exploitation.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal threats remain possible.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub, making weaponization straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.49
Vendor Advisory: https://www.dlink.com/
Restart Required: Yes
Instructions:
1. Log into D-Link support portal. 2. Download firmware version 1.1.49 for DWR-M961. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and apply the new firmware. 6. Wait for automatic reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate router management interface from untrusted networks
Access Control Lists
linuxRestrict access to port 80/443 on router to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Disable remote management interface and only allow local console access
- Implement strict network segmentation to isolate router from critical assets
🔍 How to Verify
Check if Vulnerable:
Check router web interface > System Info > Firmware Version. If version is 1.1.36 or lower, device is vulnerable.Check Version:
curl -k https://ROUTER_IP/ or check web interface manuallyVerify Fix Applied:
After upgrade, verify firmware version shows 1.1.49 or higher in System Info.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /boafrm/formStaticDHCP with long Hostname parameters
- Unusual process execution or memory errors in system logs
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Traffic spikes to router management interface
SIEM Query:
source="router_logs" AND (uri="/boafrm/formStaticDHCP" AND content_length>1000) OR (process="unexpected_binary" AND parent="httpd")