CVE-2025-10666 is a high severity buffer overflow (CVSS 8.8) in the D-Link DIR-825 router, up to version 2.10, in apply.cgi. The record says the product is no longer supported by its maintainer, so no fix should be expected. Plan to replace the device and restrict its management access.
What's affected
The record lists the D-Link DIR-825 up to version 2.10. The vulnerable function is sub_4106d4 in apply.cgi, and the argument is countdown_time.
The record states the vulnerability only affects products that are no longer supported by the maintainer. That means a vendor patch is unlikely. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, and low privileges required.
How to check if you're exposed
Log in to the router administration page and note the model and firmware version, usually on the status page. Check whether the web administration interface is reachable from the WAN side.
Then check D-Link support for an end of life notice for the model. The record says the product is unsupported, so the answer is probably that no newer firmware exists.
What to do now
- Plan to replace the DIR-825 with a supported router. No fixed firmware is indicated.
- Turn off remote administration, and make sure the web interface is not exposed to the internet.
- Place the device behind another firewall if replacement will take time.
- Change the administrator password, and check for unfamiliar settings such as DNS servers or port forwards.
- Record the device as end of life in your asset register.
Why it matters
This is CWE-120, a classic buffer copy without checking input size, within CWE-119, improper restriction of operations within memory bounds. In router firmware, a memory bug in a web handler can crash the device or, in worse cases, let someone run code on it.
The bigger story is end of life. When a vendor stops supporting a router, every new bug stays open permanently. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
The record says the exploit has been released to the public. That means technical details are available, not that attacks are confirmed.
Planning for software with no vendor fix
When no patched version is named, you have three options: fix it yourself, shield it, or retire it. Fixing it yourself works well for small PHP applications, since the change is usually one query. Shielding means network controls and a firewall rule. Retiring means moving to a maintained alternative.
Whichever you choose, write the decision down with an owner and a review date. Unpatched software tends to be forgotten rather than decided on. Continuous monitoring of your inventory against new advisories makes sure a fix, if one appears later, does not slip past you.
How scoring and records can mislead
A CVSS score is a starting point. It describes the flaw in general, not your deployment. Two things can move your real risk in either direction: whether the vulnerable component is reachable from where attackers sit, and what the process can touch once compromised.
Also keep in mind that records for newly published CVEs are often thin. Some state a vendor name and a file and little else. When the advisory is short, rely on your own inventory and on defensive basics, and revisit the record as details are added.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported by the maintainer, so a fix is unlikely. Check the D-Link support page to be sure.
What is the safest short term step?
Turn off remote administration, keep the web interface off the internet, and replace the router.
Sources
- Safeguard Gold entry for CVE-2025-10666
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md
- https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc
- https://www.dlink.com/
- https://vuldb.com/?ctiid.324787
Last reviewed: 19 October 2026.
