Trending
CVE-2025-52222

CVE detail

CVE-2025-52222

D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI-8100 v16.07.26A1, and DI-8100G v17.12.20A1 were discovered to contain a buffer overflow via the rd_en, rd_auth, rd_acct, http_hadmin, http_hadminpwd, rd_key, and rd_ip parameters in the radius_asp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVSS 7.5 · HighBuzz score 21.0

Buzz score

Why this CVE is surfacing

Buzz score total 21.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 11.0 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

11.0

2 evidence mentions in the snapshot

Diversity score

10.0

2 sources across 2 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

2 source links · newest first

https://www.dlink.com/en/security-bulletin/www.dlink.com
No excerpt available.
Vendor Advisorywww.dlink.comApr 8, 2026, 6:24 PM
https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.mdgithub.com
No excerpt available.
Exploitgithub.comApr 8, 2026, 6:24 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-7857
A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipula…
CVSS 7.3 · High
Public PoC observed5 mentions
CVE-2026-7856
A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management Interface. Executing a manipulation of…
CVSS 7.3 · High
Public PoC observed5 mentions
CVE-2026-7855
A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing…
CVSS 7.4 · High
Public PoC observed5 mentions
CVE-2026-7854
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POS…
CVSS 8.9 · High
Public PoC observed5 mentions
CVE-2026-7853
A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the…
CVSS 8.9 · High
Public PoC observed5 mentions
CVE-2026-7248
A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI Endpoint. The manipulation of the argument…
CVSS 8.9 · High
Public PoC observed5 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2025-52222.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:h:dlink:di-8003Search this product on Shodan
cpe:2.3:o:dlink:di-8003_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8003gSearch this product on Shodan
cpe:2.3:o:dlink:di-8003g_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8004wSearch this product on Shodan
cpe:2.3:o:dlink:di-8004w_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8100Search this product on Shodan
cpe:2.3:o:dlink:di-8100_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8100gSearch this product on Shodan
cpe:2.3:o:dlink:di-8100g_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8200Search this product on Shodan
cpe:2.3:o:dlink:di-8200_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8200gSearch this product on Shodan
cpe:2.3:o:dlink:di-8200g_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8400Search this product on Shodan
cpe:2.3:o:dlink:di-8400_firmwareSearch this product on Shodan
cpe:2.3:h:dlink:di-8500Search this product on Shodan
cpe:2.3:o:dlink:di-8500_firmwareSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2025-52222Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

Apr 8, 2026

Modified

Jul 25, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): None. There is no direct impact to this security property.
Integrity Impact (I): None. There is no direct impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses