Critical buffer overflow flaw reported in D-Link DIR-825 routers
Take action: If you have a D-Link DIR-825 router, isolate its web interface from any public networks and block external access since this model is no longer supported with security updates. Consider replacing the router since it won't be getting any patches. And other flaws will be found.
Learn More
Security researchers are reporting a critical buffer overflow vulnerability in D-Link DIR-825 routers that enables remote attackers to cause denial-of-service conditions without authentication.
The vulnerability is tracked as CVE-2025-7206 (CVSS score 9.3) and is caused by insufficient input validation in the router's httpd binary when processing language parameters through the switch_language.cgi script, allowing attackers to trigger memory corruption and crash the device's web service.
Attackers can submit a malicious language parameter via the switch_language.cgi script. This value gets stored in nvram through the router's configuration management system. Subsequently, when users access any ASP page containing specific script tags that reference language-dependent JavaScript files, the router retrieves the stored language value and processes it through multiple parsing functions, triggering a buffer overflow condition, causing the web service to crash.
The flaw was discovered by security researcher iC0rner (Mingjie Liang). It affects D-Link DIR-825 Rev.B 2.10 firmware versions. Unfortunately, the vulnerability affects products that are no longer supported by the maintainer. Users should isolate the web interface of the router from any public networks, and consider replacing the router.
