High severity · published Apr 18, 2025
CVE-2025-3785
D-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflow
8.8
CVSS
12.8%
EPSS
No
On KEV
Description
A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
DWR-M961 · D-Link
1.1.36 · source: vendor
DF
Dwr-m961 Firmware · Dlink
1.1.36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3785
Broken Link
https://github.com/ZOKEYE/CVE/blob/main/D-link.md
Permissions Required
https://vuldb.com/?ctiid.305608
Third Party Advisory
https://vuldb.com/?id.305608
Third Party Advisory
https://vuldb.com/?submit.553547
Product
https://www.dlink.com/
More from DWR-M961
8.8
CVE-2026-1625
D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection
8.8
CVE-2026-1624
D-Link DWR-M961 formLtefotaUpgradeFibocom command injection
8.8
CVE-2026-1596
D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection
8.8
CVE-2025-13304
D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow