CVE-2025-10666
Last modified
CVE-2025-10666 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. EPSS estimates a 3.04% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-825 Firmware | <= 2.10 |
References
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.mdExploit, Third Party Advisory
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#pocExploit, Third Party Advisory
- https://vuldb.com/?ctiid.324787Permissions Required, VDB Entry
- https://vuldb.com/?id.324787Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.652047Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.mdExploit, Third Party Advisory
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#pocExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-10666?
How severe is CVE-2025-10666?
How do I fix CVE-2025-10666?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-1066OpenPLC_V3 contains an arbitrary file upload vulnerability, …9.8
- CVE-2025-10660The WP Dashboard Chat plugin for WordPress is vulnerable to …6.5
- CVE-2025-10662A vulnerability has been found in SeaCMS up to 13.3. The imp…9.8
- CVE-2025-10663A vulnerability was found in PHPGurukul Online Course Regist…9.8
- CVE-2025-10664A vulnerability was determined in PHPGurukul Small CRM 4.0. …9.8
- CVE-2025-10665A vulnerability was identified in kidaze CourseSelectionSyst…9.8
- CVE-2025-10667A weakness has been identified in itsourcecode Online Discus…9.8
- CVE-2025-10668A security vulnerability has been detected in itsourcecode O…9.8
- CVE-2025-10669A vulnerability was detected in Airsonic-Advanced up to 10.6…6.3
- CVE-2025-1067There is an untrusted search path vulnerability in Esri ArcG…7.3
- CVE-2025-10670A flaw has been found in itsourcecode E-Logbook with Health …9.8
- CVE-2025-10671A vulnerability has been found in youth-is-as-pale-as-poetry…3.7
Are you affected by CVE-2025-10666?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST