Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-3785: D-Link DWR-M961: Remote Code Execution from Malicious Hostname

CVE-2025-3785 · published 1 year ago

Summary

A critical flaw in the D-Link DWR-M961 firmware lets an attacker send a specially crafted request to execute malicious code on the device. This could lead to unauthorized access or disruption of the device. Upgrading to version 1.1.49 is the recommended fix to address this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dlink	dwr-m961_firmware	1.1.36 `cpe:2.3:o:dlink:dwr-m961_firmware:1.1.36:::::::*`

Original advisory text

A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component.

References

https://github.com/ZOKEYE/CVE/blob/main/D-link.md Broken Link
https://vuldb.com/?ctiid.305608 Permissions Required VDB Entry
https://vuldb.com/?id.305608 Third Party Advisory VDB Entry
https://vuldb.com/?submit.553547 Third Party Advisory VDB Entry
https://www.dlink.com/ Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.7 High

Exploitation

13% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-121Stack-based Buffer Overflow

Timeline

Published18 Apr 2025

Updated16 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-3785 · NVD

Track software like this

Free during beta