Dir 825
Vendor:
First CVE: Sep 27, 2019 · Active for 6 years
20
Total CVEs
More Total CVEs than 94% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 74% of tracked products
8.8
Avg CVSS
Higher Avg CVSS than 82% of tracked products
10.0%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Dir 825 over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 27, 2019
6 years ago
Most Recent CVE
Apr 27, 2026
88 days ago
CVE Severity & Scoring
Dir 82520 CVEs
10%
50%
40%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network18 (90.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network2 (10.0%)
Attack Complexity
Low20 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None20 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low9 (45.0%)
High0 (0.0%)
None11 (55.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-16920CRITICAL Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a | Sep 27, 2019 | 9.8 | 98 | YES | YES |
CVE-2020-29557CRITICAL An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote c | Jan 29, 2021 | 9.8 | 89 | YES | NO |
CVE-2021-46442CRITICAL In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files | Apr 27, 2022 | 9.8 | 54 | NO | NO |
CVE-2025-10666CRITICAL A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument | Sep 18, 2025 | 9.8 | 44 | NO | YES |
CVE-2021-46441HIGH In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system commands after obtaining | Apr 27, 2022 | 8.8 | 44 | NO | NO |
CVE-2025-7206CRITICAL A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switch_language.cgi of the componen | Jul 9, 2025 | 9.8 | 39 | NO | NO |
CVE-2026-7068HIGH A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer over | Apr 27, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-7069HIGH A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipu | Apr 27, 2026 | 8.0 | 33 | NO | NO |
CVE-2025-10034CRITICAL A vulnerability was found in D-Link DIR-825 1.08.01. This impacts the function get_ping6_app_stat of the file ping6_response.cg of the component httpd. Performing manipulation of t | Sep 6, 2025 | 9.8 | 32 | NO | NO |
CVE-2022-47035CRITICAL Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint. | Jan 31, 2023 | 9.8 | 31 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
2 CVEs
10.0% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.0% of CVEs· 97th percentile
ExploitDB
1 CVE
5.0% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Dir 825
Top CWEs
Versions
No cataloged versions.