CVE-2025-2619
Last modified
CVE-2025-2619 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. EPSS estimates a 1.85% chance of exploitation in the next 30 days.
Description
A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dap-1620 Firmware | 1.03 |
References
- https://vuldb.com/?ctiid.300621Permissions Required, VDB Entry
- https://vuldb.com/?id.300621Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.518968Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-2619?
How severe is CVE-2025-2619?
How do I fix CVE-2025-2619?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-26168IXON VPN Client before 1.4.4 on Linux and macOS allows Local…8.1
- CVE-2025-26169IXON VPN Client before 1.4.4 on Windows allows Local Privile…8.1
- CVE-2025-2617A vulnerability classified as problematic was found in yangy…4.8
- CVE-2025-2618A vulnerability, which was classified as critical, has been …9.8
- CVE-2025-26182An issue in xxyopen novel plus v.4.4.0 and before allows a r…6.5
- CVE-2025-26186SQL Injection vulnerability in openSIS v.9.1 allows a remote…8.1
- CVE-2025-26198CloudClassroom-PHP-Project v1.0 contains a critical SQL Inje…9.8
- CVE-2025-26199CloudClassroom-PHP-Project v1.0 is affected by an insecure c…9.8
- CVE-2025-2620A vulnerability has been found in D-Link DAP-1620 1.03 and c…9.8
- CVE-2025-26200SQL injection in SLIMS v.9.6.1 allows a remote attacker to e…7.2
- CVE-2025-26201Credential disclosure vulnerability via the /staff route in …9.1
- CVE-2025-26202Cross-Site Scripting (XSS) vulnerability exists in the WPA/W…4.3
Are you affected by CVE-2025-2619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST