ID

VAR-202504-1162


CVE

CVE-2025-3785


TITLE

D-Link DWR-M961 Buffer Overflow Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-11233

DESCRIPTION

A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component. D-Link DWR-M961 is a router from D-Link, a Chinese company. D-Link DWR-M961 has a buffer overflow vulnerability. The vulnerability is caused by the failure of the parameter Hostname in the file /boafrm/formStaticDHCP to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.44

sources: NVD: CVE-2025-3785 // CNVD: CNVD-2025-11233

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-11233

AFFECTED PRODUCTS

vendor:d linkmodel:dwr-m961scope:eqversion:1.1.36

Trust: 0.6

sources: CNVD: CNVD-2025-11233

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-3785
value: HIGH

Trust: 1.0

CNVD: CNVD-2025-11233
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-3785
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2025-11233
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-3785
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-11233 // NVD: CVE-2025-3785

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-121

Trust: 1.0

sources: NVD: CVE-2025-3785

EXTERNAL IDS

db:NVDid:CVE-2025-3785

Trust: 1.6

db:VULDBid:305608

Trust: 1.0

db:CNVDid:CNVD-2025-11233

Trust: 0.6

sources: CNVD: CNVD-2025-11233 // NVD: CVE-2025-3785

REFERENCES

url:https://github.com/zokeye/cve/blob/main/d-link.md

Trust: 1.6

url:https://vuldb.com/?id.305608

Trust: 1.0

url:https://vuldb.com/?ctiid.305608

Trust: 1.0

url:https://www.dlink.com/

Trust: 1.0

url:https://vuldb.com/?submit.553547

Trust: 1.0

sources: CNVD: CNVD-2025-11233 // NVD: CVE-2025-3785

SOURCES

db:CNVDid:CNVD-2025-11233
db:NVDid:CVE-2025-3785

LAST UPDATE DATE

2025-06-02T23:36:48.046000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-11233date:2025-05-30T00:00:00
db:NVDid:CVE-2025-3785date:2025-04-21T14:23:45.950

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-11233date:2025-05-30T00:00:00
db:NVDid:CVE-2025-3785date:2025-04-18T09:15:15.440