CVE-2025-25742: Critical Buffer Overflow in D-Link DIR-853

CVE-2025-25742 is a critical (CVSS 9.8) stack based buffer overflow in the D-Link DIR-853, firmware A1 FW1.20B07. The record lists no fixed version. Check D-Link's support page for new firmware, turn off remote administration, and replace the device if it no longer receives updates.

What's affected

• Product: D-Link DIR-853 router or access point and its firmware.
• Affected: firmware A1 FW1.20B07, as named in the record. Other builds may share the code, so do not assume a newer or older build is safe without checking the vendor.
• Fixed: the record names no fixed version. Check the vendor's download page, and read any release notes before you flash.
• Detail: the SetSysEmailSettings module does not bound the AccountPassword parameter. It sits in the email notification settings handler.
• Vector: network reachable, no login and no user interaction, which is how it reaches 9.8.

How to check if you're exposed

Find the firmware version in the router's admin page, usually under a system status or firmware upgrade menu. Menu names differ by model, so use the vendor's manual if you cannot find it. Compare the version string with A1 FW1.20B07.

Then check whether the admin interface is reachable from the wrong places. From a machine outside your network, scan only your own public address.

nmap -Pn -p 80,443,8080 <your-public-ip>

Also check the router's settings for remote management, port forwarding and UPnP rules. If the web interface answers from the internet, treat the device as exposed. Look at the device logs if it keeps any, and for unexpected reboots or changed settings, which can indicate someone tried to use a flaw like this.

At a larger site, build a list of every D-Link device with its model and firmware so you know how many are affected.

What to do now

1. Check D-Link's support or download page for firmware newer than A1 FW1.20B07 for the DIR-853, and read its release notes before you flash.
2. Turn off remote administration and make sure no port forward or UPnP rule exposes the web interface.
3. Restrict the admin page to a small set of trusted internal addresses, and change the admin password to a long unique one.
4. Keep guests and untrusted devices on a separate network from the one that can reach the admin interface.
5. If no update exists or the product is out of support, plan to replace the device with a model that still receives security fixes.
6. If the device was exposed to the internet, check its settings for changes you did not make, reset it to factory defaults and reconfigure it from scratch.

Why it matters

The class is a memory safety bug. A web handler on the device reads a request value and copies it into a fixed size buffer without checking its length. When the value is longer than the buffer, the extra bytes overwrite neighbouring memory on the stack.

• CWE-787 is an out of bounds write. Memory outside the intended buffer gets overwritten, which on embedded devices can corrupt control data and change what the program does next.

The record tags an out of bounds write, which is the memory effect of an overflow. The effect on the device is memory corruption on the device, which can mean a crash or code execution with the privileges of the web service. Consumer and small office routers sit at the network edge and see every connection in and out, which makes a compromise valuable. They also tend to run old firmware for years because nobody owns the update task.

The published writeup is by an independent researcher, and the record does not say the vendor has responded. D-Link sells many models on shared codebases, so a bug in one build often points to the same pattern elsewhere. Reduce exposure first. The router's web interface should never face the internet, and the update question should be on your inventory.

Quick check

Sources

• Reference in the CVE record for CVE-2025-25742

Last reviewed: 19 October 2026.