A buffer overflow exists in the AddPortMapping function of miniupnpd’s upnpsoap.c. When an attacker sends a specially crafted NewPortMappingDescription argument, the vulnerable buffer overflows, potentially allowing execution of arbitrary code on the device. The flaw maps to CWE‑119 and CWE‑120 and requires an attacker to be on the same local network to trigger the exploit. This could lead to a full compromise of the router’s firmware and loss of confidentiality, integrity, and availability.

D‑Link DIR‑825 routers running firmware versions up to 3.00b32, which are no longer supported. No other vendors or products are reported to be affected.

The CVSS score of 8.6 classifies this vulnerability as high severity. EPSS is less than 1%, indicating a low frequency of observed exploitation, but public exploits have been released and could be leveraged in environments where an attacker can reach the device over the local network. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, yet the combination of a high severity score and local network reachability makes it a significant risk for unattended or exposed devices.