Vulnerability · Published Nov 17, 2025 · Assigned by VulDB
CVE-2025-13306D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection
Medium 6.3
In plain English
A medium-severity command injection in DIR-822K from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)8.3%top 5.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-332646 | D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection vdb-entry, technical-description
- VDB-332646 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #691813 | D-Link DWR-M920 V1.1.5 Command Injection third-party-advisory
- Submit #693805 | D-Link DIR-822k TK_1.00_20250513164613 Command Injection (Duplicate) third-party-advisory
- Submit #693807 | D-Link DWR-M921 V1.1.50 Command Injection (Duplicate) third-party-advisory
- Submit #695426 | D-Link DIR-825m v1.1.12 Command Injection (Duplicate) third-party-advisory
- https://github.com/LX-LX88/cve/issues/15 exploit, issue-tracking
- https://www.dlink.com/ product