High severity · published Apr 18, 2025
CVE-2025-3785
A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical
8.8
CVSS
12.8%
EPSS
No
On KEV
Description
A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dwr-m961 Firmware · Dlink
1.1.36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3785
Broken Link
https://github.com/ZOKEYE/CVE/blob/main/D-link.md
Permissions Required
https://vuldb.com/?ctiid.305608
Third Party Advisory
https://vuldb.com/?id.305608
Third Party Advisory
https://vuldb.com/?submit.553547
Product
https://www.dlink.com/
More from Dwr-m961 Firmware
9.8
CVE-2025-13305
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07
8.8
CVE-2026-1625
D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection
8.8
CVE-2026-1624
D-Link DWR-M961 formLtefotaUpgradeFibocom command injection
8.8
CVE-2026-1596
D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection
8.8
CVE-2025-13304
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47