D-Link DIR-825 Firmware vulnerabilities

19 CVEs affecting D-Link DIR-825 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-7069, published 2026-04-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16920: D-Link Multiple Routers Command Injection Vulnerability, published 2019-09-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device…
CVE-2021-46442, published 2022-04-27. Critical severity, CVSS 9.8. EPSS: 56.1% chance of exploitation in the next 30 days. In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating…
CVE-2021-46441, published 2022-04-27. High severity, CVSS 8.8. EPSS: 32.6% chance of exploitation in the next 30 days. In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system commands after obtaining authorization.
CVE-2025-7206, published 2025-07-09. Critical severity, CVSS 9.8. EPSS: 21.7% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switch_language.cgi of the component httpd. The…
CVE-2020-10214, published 2020-03-07. High severity, CVSS 8.8. EPSS: 18.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to…
CVE-2024-0717, published 2024-01-19. Medium severity, CVSS 5.3. EPSS: 18.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820,…
CVE-2020-10215, published 2020-03-07. High severity, CVSS 8.8. EPSS: 5.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet…
CVE-2020-10216, published 2020-03-07. High severity, CVSS 8.8. EPSS: 5% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP…
CVE-2020-10213, published 2020-03-07. High severity, CVSS 8.8. EPSS: 5% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST…
CVE-2025-10666, published 2025-09-18. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time…

Latest

CVE-2026-7069, published 2026-04-27. High severity, CVSS 8.0. EPSS: 0.7% chance of exploitation in the next 30 days. A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipulation of the…
CVE-2026-7068, published 2026-04-27. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer overflow. The attack…
CVE-2025-10034, published 2025-09-06. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-825 1.08.01. This impacts the function get_ping6_app_stat of the file ping6_response.cg of the component httpd. Performing manipulation of the argument…
CVE-2025-8949, published 2025-08-14. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the…
CVE-2025-6292, published 2025-06-20. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads…
CVE-2025-6291, published 2025-06-20. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to…
CVE-2022-47035, published 2023-01-31. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.