CVE-2025-13306

D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection

State: Published
Severity: 5.3 Medium
Published: Nov 17, 2025
Updated: Nov 18, 2025
Reserved: Nov 17, 2025

Description

A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
DWR-M920D-Link	1.1.5Affected
DWR-M921D-Link	1.1.5Affected
DIR-822KD-Link	1.1.5Affected
DIR-825MD-Link	1.1.5Affected

References

VDB-332646 | D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionvdb-entrytechnical-description
VDB-332646 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #691813 | D-Link DWR-M920 V1.1.5 Command Injectionthird-party-advisory
Submit #693805 | D-Link DIR-822k TK_1.00_20250513164613 Command Injection (Duplicate)third-party-advisory
Submit #693807 | D-Link DWR-M921 V1.1.50 Command Injection (Duplicate)third-party-advisory
Submit #695426 | D-Link DIR-825m v1.1.12 Command Injection (Duplicate)third-party-advisory
https://github.com/LX-LX88/cve/issues/15exploitissue-tracking
https://www.dlink.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.