CVE-2025-8949 is a high severity (CVSS 7.2) stack based buffer overflow in the D-Link DIR-825 router, firmware 2.10. The record says the ping_ipaddr argument handled by get_ping_app_stat in ping_response.cgi triggers it. I could not confirm a fixed firmware version, so check D-Link before relying on one.
The weakness classes are CWE-119 and CWE-121: a memory safety error, in this case on the stack.
What's affected
D-Link DIR-825, version 2.10, per the record. The public report linked from the record says it tested the Rev.B 2.10 firmware. The vulnerable code is in the router's httpd component, in the function get_ping_app_stat of ping_response.cgi, which is part of the router's web administration interface.
The record scores it 7.2 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. In plain terms: reachable over the network, low attack complexity, a high privilege account is needed, no user interaction, and high impact on confidentiality, integrity and availability. The public report says a login is part of the trigger steps, which fits the high privilege requirement in the vector.
The record lists no fixed version. The record and the report disagree in emphasis, not in facts. The vector rates impact as high across the board, while the report says the observed result is a crash of the web server. Treat the report's description as what was shown, and the vector as the worst case NVD scoring allows.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the status or tools page. If you have a DIR-825 on 2.10, you are in scope.
If you manage several devices, find where the admin interface is reachable. The risk grows sharply if the interface is exposed to the internet or to a guest network.
nmap -p 80,443,8080 192.168.0.0/24
Any DIR-825 that answers on a management port from a network that should not reach it needs attention first. Then compare the version against D-Link's support page for your hardware revision. I did not retrieve a D-Link advisory for this CVE, so the vendor page is where you should look for fixed firmware and for the support status of the model.
What to do now
- Identify every DIR-825 you run and its hardware revision and firmware version.
- Turn off remote administration and make sure the admin page is reachable only from a trusted LAN segment.
- Change the admin password to a long unique one, since the report describes an authenticated trigger.
- Look on D-Link's support site for updated firmware for your revision. If none exists, plan to replace the unit.
- Keep the router out of any network that holds sensitive systems until it is patched or replaced.
- Record the device in your asset inventory so the next advisory does not catch you out.
Why it matters
A stack overflow happens when input is copied into a fixed size buffer on the stack without a length check. The report traces this one to a helper function that is meant to escape special characters. It copies the user supplied value into a stack variable with strcpy, so a long enough value overruns the buffer. The issue sits in code that was added to prevent a different class of bug, which is a reminder that a safety function needs its own bounds checks.
On a router, memory corruption bugs are worth taking seriously even when the published result is only a crash. A crash takes down the device that connects everything else. Whether the flaw can go further depends on the firmware build and protections, and I have not seen that shown, so I will not claim it.
The KEV flag in the record is false, and I found no advisory saying this is exploited in the wild. The record does say the exploit has been disclosed to the public.
Quick check
Does an attacker need to log in first?
The vector requires a high privilege account, and the public report lists logging in as part of the steps. That lowers the risk compared with an unauthenticated bug, but weak or default admin passwords on routers are common, so do not rely on it.
Is there a patch?
I could not confirm one. The record names no fixed version and I did not retrieve a D-Link bulletin. Check D-Link's support page for your hardware revision. If the model is no longer supported, replacing it is the safe option.
Sources
- Gold entry for CVE-2025-8949
- Public report linked from the record
- CWE-119 and CWE-121
- D-Link is listed in the record as the vendor page; I did not retrieve an advisory from it
Last reviewed: 18 October 2026.
