CVE-2020-29557: D-Link DIR-825 R1 web interface buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityPre-authentication remote code execution on an internet-facing edge device that is in CISA's KEV catalog with a very high EPSS score.

What it is

D-Link DIR-825 R1 devices running firmware through 3.0.1 before 2020-11-20 contain a buffer overflow in the web interface. The flaw allows pre-authentication remote code execution, meaning an attacker can run code on the router without any credentials. Because the device sits at the network edge, compromise gives an attacker a foothold on the internal network.

Impact

An unauthenticated attacker gains remote code execution on the router, allowing full control of the device, interception or redirection of traffic, and use as a pivot into the connected network.

Attack surface

Reachable over the network through the device's web interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

CVE-2020-29557 is listed in CISA's Known Exploited Vulnerabilities catalog, and a public exploit reference exists, indicating active exploitation. EPSS gives a 30-day probability of 0.5432 (98.9th percentile), a high likelihood of exploitation activity.

What to do

• Apply the vendor firmware update for DIR-825 R1 (fixed after 2020-11-20) as the first action.
• If the device cannot be patched or is end-of-life, replace it or remove it from the network.
• Disable remote administration of the web interface and restrict management access to trusted internal hosts only.
• Segment or isolate the router from sensitive internal systems until patched.
• Monitor vendor advisories for any further updates to this model.

Detection

• Inspect router and perimeter logs for unusual HTTP requests to the web interface, especially oversized or malformed payloads.
• Alert on unexpected outbound connections or new listening services originating from the router.
• Monitor for configuration changes, new admin accounts, or firmware modifications on the device.
• Watch for the device being used as a pivot, such as scanning or lateral movement sourced from the router's IP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.