Dir 825 Firmware

Vendor:

First CVE: Sep 27, 2019 · Active for 6 years

19
Total CVEs
More Total CVEs than 95% of tracked products
2.4
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
8.8
Avg CVSS
Higher Avg CVSS than 79% of tracked products
5.3%
KEV Rate
Higher KEV Rate than 98% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Dir 825 Firmware over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 27, 2019
6 years ago
Most Recent CVE
Apr 27, 2026
92 days ago

CVE Severity & Scoring

Dir 825 Firmware19 CVEs
All CVEs352,785 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network17 (89.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network2 (10.5%)
Attack Complexity
Low19 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None19 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low9 (47.4%)
High0 (0.0%)
None10 (52.6%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (19 CVEs).

19 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2019-16920CRITICAL
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a
Sep 27, 20199.898YESYES
CVE-2021-46442CRITICAL
In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files
Apr 27, 20229.854NONO
CVE-2025-10666CRITICAL
A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument
Sep 18, 20259.844NOYES
CVE-2021-46441HIGH
In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system commands after obtaining
Apr 27, 20228.844NONO
CVE-2025-7206CRITICAL
A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switch_language.cgi of the componen
Jul 9, 20259.839NONO
CVE-2025-10034CRITICAL
A vulnerability was found in D-Link DIR-825 1.08.01. This impacts the function get_ping6_app_stat of the file ping6_response.cg of the component httpd. Performing manipulation of t
Sep 6, 20259.832NONO
CVE-2026-7068HIGH
A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer over
Apr 27, 20268.831NONO
CVE-2022-47035CRITICAL
Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.
Jan 31, 20239.831NONO
CVE-2025-8949CRITICAL
A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The ma
Aug 14, 20259.830NONO
CVE-2020-10214HIGH
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code
Mar 7, 20208.830NONO
View all 19 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (19 CVEs).

CISA KEV
1 CVE
5.3% of CVEs· 98th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.3% of CVEs· 97th percentile
ExploitDB
1 CVE
5.3% of CVEs· 86th percentile

Social Chatter

Signals from CVEs in this product scope (19 CVEs).

Media Mentions

Signals from CVEs in this product scope (19 CVEs).

Top CNAs Publishing CVEs For Dir 825 Firmware

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
3.00b3228.41.6%00
2.10b0217.51.1%00
2.1069.18.4%00
2.0328.80.9%00
2022.01.13-13.4816.51.4%00
1.08.0119.80.9%00