cbcvebase.
CVE-2025-10666
published 2025-09-18

CVE-2025-10666: A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The…

PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
3.04%
86.0th percentile
A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

12 ranges
VendorProductVersion rangeFixed in
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
d-linkdir-825——
dlinkdir-825_firmware<= 2.10—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://192.168.0.1/apply.cgi↗
path/apply.cgi↗
commandPOST /apply.cgi countdown_time=<100+ chars>
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link apply.cgi countdown_time Parameter Buffer Overflow Attempt (CVE-2025-10666)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:10; content:"/apply.cgi"; http.request_body; content:"countdown_time|3d|"; fast_pattern; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc; reference:cve,2025-10666; classtype:web-application-attack; sid:2064801; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_09_18, cve CVE_2025_10666, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Detect HTTP POST requests to /apply.cgi with a `countdown_time` parameter value exceeding 100 characters — the Snort/ET rule uses pcre `/^[^&]{100,}(?:&|$)/R` against the request body after matching `countdown_time=` (hex `countdown_time|3d|`). ↗
  • →The vulnerable function is `sub_4106d4` inside `apply.cgi`; monitor for crashes or unresponsiveness of the D-Link DIR-825 Rev.B process after POST requests to that endpoint. ↗
  • →The ET rule (SID 2064801) is scoped to plaintext (non-TLS) traffic only (`tls_state plaintext`), so deploy on perimeter and internal sensors monitoring unencrypted HTTP to router management interfaces.
  • →Reference PoC documentation is publicly available at github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc — useful for additional payload variants.
  • ·The default target IP in the PoC is 192.168.0.1 (the router's LAN-side default gateway); the attack is network-accessible but typically requires LAN or WAN access to the management interface — adjust $HOME_NET in the Snort rule to cover router management subnets. ↗
  • ·This vulnerability only affects D-Link DIR-825 Rev.B firmware <= 2.10, which is end-of-life with no patch available from the vendor. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.