CVE-2020-29557

CVE-2020-29557 is a critical buffer overflow (CVSS 9.8) in the web interface of D-Link DIR-825 R1 routers running firmware through 3.0.1. Because the flaw is reachable without authentication, a remote attacker can send crafted requests to the router's HTTP management interface and trigger the overflow to execute arbitrary code on the device. Successful exploitation gives the attacker full control of the router, typically enabling traffic interception, further network compromise, or use of the device as an attack pivot or botnet node. Any DIR-825 R1 device whose management interface is reachable — especially units exposed directly to the internet — is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities (added 2021-11-03) and a public proof-of-concept exists, indicating exploitation in the wild.

What to do: Upgrade DIR-825 R1 devices to the fixed firmware released on 2020-11-20 or later, per D-Link's update instructions. Until patched, restrict or disable web-based administration from the WAN side and allow management access only from trusted networks. Given the KEV listing and ~54% EPSS, prioritize internet-facing units and review router logs for signs of compromise.