CVE-2025-7206: A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file…

PriorityP277critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

15.98%

96.5th percentile

A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switch_language.cgi of the component httpd. The manipulation of the argument Language leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-825	—	—
dlink	dir-825_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/switch_language.cgi↗

urlhttps://github.com/i-Corner/cve/issues/2

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link switch_language.cgi language Parameter Buffer Overflow (CVE-2025-7206)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/switch_language.cgi"; fast_pattern; http.request_body; content:"language|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/i-Corner/cve/issues/2; reference:cve,2025-7206; classtype:web-application-attack; sid:2063370; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_09, cve CVE_2025_7206, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Exploit uses HTTP POST method targeting /switch_language.cgi on D-Link DIR-825 httpd; detect POST requests to this URI.
→The overflow is triggered via the 'language' POST body parameter (URL-encoded as 'language='); look for 'language=' followed by 100 or more characters before an '&' or end of body.
→Traffic is expected in plaintext (not TLS); deploy detection at perimeter and internal network boundaries.
→The vulnerable function is sub_410DDC inside switch_language.cgi handled by the httpd component; focus reverse-engineering and binary analysis on this function.

·This vulnerability only affects D-Link DIR-825 version 2.10, which is end-of-life and no longer supported by the vendor; no official patch will be issued. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.