CVE-2025-7206

A critical stack-based buffer overflow (CWE-121/CWE-119) affects the httpd component of D-Link DIR-825 firmware 2.10, in the sub_410DDC function of switch_language.cgi. An attacker can trigger it remotely by manipulating the Language argument, with no privileges or user interaction required. Successful exploitation can compromise confidentiality, integrity, and availability of the device (CVSS 4.0 8.9). Only this unsupported firmware release is identified as affected. A public proof-of-concept has been disclosed and may be used; it is not listed in CISA KEV, so confirmed in-the-wild exploitation is not established, though EPSS is elevated at about 21.7%.

What to do: DIR-825 firmware 2.10 is no longer supported, so there is no vendor patch; replace the router with a currently supported model. Until then, do not expose the device web interface (httpd) to the internet, disable remote administration, and restrict management to a trusted LAN.