CVE-2025-10034: High Buffer Overflow in D-Link DIR-825 Router

CVE-2025-10034 is a high severity buffer overflow (CVSS 8.8) in the D-Link DIR-825 router, firmware 1.08.01, reachable over the network. The record says the product is no longer supported by the maintainer, so the practical fix is to replace the device and, until then, block access to its admin interface.

What's affected

The record names the D-Link DIR-825 at firmware version 1.08.01. The flaw is in the function get_ping6_app_stat of the file ping6_response.cg in the httpd component, and the ping6_ipaddr argument leads to a buffer overflow. The weakness classes are CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer copy without checking input size).

The record states that the vulnerability only affects products that are no longer supported by the maintainer. That wording matters. A vendor that has ended support generally ships no firmware fixes, and the record lists no fixed version. I could not retrieve the vendor or researcher pages to confirm anything further, so check D-Link's support and security pages for the DIR-825 yourself.

The score is 8.8 HIGH. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reads as network reachable, low attack complexity, a low-privilege account and no user interaction. Impact on confidentiality is high, on integrity high, and on availability high. A low privilege requirement means an attacker may need to be logged in or otherwise have some access first, depending on how the device is configured.

How to check if you're exposed

1. Find the router. Look at the label on the underside, which shows the model and hardware revision.
2. Log into the admin page from inside your network and read the firmware version on the status page. Compare it with 1.08.01.
3. Check whether remote administration is turned on. If the admin page answers from the internet, exposure is much higher.
4. From outside your network, test whether the router's admin port responds, using a scan you are authorized to run against your own address.

What to do now

1. Plan to replace the DIR-825 with a router that still receives security updates. This is the only complete fix for an unsupported device.
2. Turn off remote administration on the WAN side right away.
3. Restrict the admin interface to a single trusted machine on the local network, and change the admin password to a long unique one.
4. Segment the router's network from sensitive systems where you can, so a compromised router has less to reach.
5. Check the router's logs and your DNS settings for unexpected changes.
6. Keep an inventory of edge devices with their support status. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.

Why it matters

A buffer overflow happens when a program copies input into a fixed-size space without checking its length. On a router the web server often runs with high privileges, so a memory bug there can become control of the device. Control of the router means control of the traffic that passes through it.

End of life is the harder problem. Patching is the normal answer to a vulnerability, but unsupported hardware does not get patches, and each new disclosure widens the gap. The record is not flagged by CISA as exploited in the wild, and I found no statement of exploitation, yet the exploit is described as public. Treat unsupported routers as a retirement project, not a patch ticket.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2025-10034, including its references to the researcher write-up and the D-Link site (not independently verified)
• D-Link

Last reviewed: 19 October 2026.