Medium severity · published May 17, 2022
CVE-2022-29332
D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the FTP server folder to set the router's root folder for FTP access. This allows you to access the entire router file system via the FTP server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-825 Firmware · Dlink
2022.01.13-13.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29332
Exploit
https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/d-link_dir-825_R2.pdf
More from Dir-825 Firmware
9.8
CVE-2019-16920
D-Link Multiple Routers Command Injection Vulnerability
9.8
CVE-2025-10666
A security flaw has been discovered in D-Link DIR-825 up to 2.10
9.8
CVE-2025-10034
A vulnerability was found in D-Link DIR-825 1.08.01
9.8
CVE-2025-8949
A vulnerability was identified in D-Link DIR-825 2.10
9.8
CVE-2025-7206
A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10