CVE-2020-29557

CRITICAL

9.8

CVSS Score

Published: January 29, 2021 at 07:32 PM UTC

Updated: June 17, 2026 at 03:11 AM UTC

6 products affected across 1 vendorDir 825 R1 FirmwareDir 825Dir-825/Ac

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploitation

CISA KEV

Exploit prediction

EPSS 56%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score55.7%

EPSS (Exploit Prediction Scoring System) estimates a 55.7% chance this CVE is exploited in the wild within the next 30 days — higher than 99% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

Nov 3, 2021

Remediation Due

May 3, 2022

1640 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-29557

Description

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Dir 825 R1 Firmware · D-Link

95%

v ≤ 3.0.1

dlink-dir-825-a (environment) · dlink-dir-825-ac (environment) · dlink-dir-825-acf (environment) · dlink-dir-825-gf (environment) · dlink-dir-825 (same device)

Dir 825 · D-Linkdevice

80%

All versions

Dir-825/A · D-Linkdevice

80%

All versions

Dir-825/Ac · D-Linkdevice

80%

All versions

Dir-825/Acf · D-Linkdevice

80%

All versions