Actively exploited in the wild

D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability

D-Link - DIR-825 R1 Devices · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2020-29557

CriticalCVSS 9.8KEV

Published: 29/01/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Risk Assessment

An unauthenticated attacker can remotely execute arbitrary code on the device, leading to full compromise of the router and the network.

Recommendation

Update the router firmware to a version newer than 3.0.1 (released after 2020-11-20) and restrict web interface access from the WAN.

Other vulnerabilities in D-Link DIR-825

CVE-2026-96891Critical
A vulnerability was identified in D-Link DIR-825 3.00b32 in the tunnel_set_params function of tunnel.c in the rp-l2tp component. Manipulation of the peer_hostname argument leads to an out-of-bounds write. The attack may be initiated remotely.

Original NVD description (English source)

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS