CVE-2018-25125 json
Netis DL4322D RTK 2.1.1 FTP Service DoS
published 2025-11-14 11 mo ago modified 2026-06-17 4 mo ago also EUVD-2018-21612
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticated remote user to trigger a denial of service. After logging in to the FTP service, sending an FTP command such as ABOR with an excessively long argument causes the service, and in practice the router, to crash or become unresponsive, resulting in a loss of availability for the device and connected users.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- exploit-db.com https://www.exploit-db.com/exploits/45424 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Netis Systems Co., Ltd. DL4322D
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
exploit-db.com
/exploits/45424
exploit
-
web.archive.org
/web/20180731191918/http://www.netis-systems.com/Home/detail/id/74.html
product
-
netis-systems.com
/
product
-
vulncheck.com
/advisories/netis-dl4322d-ftp-service-dos
third-party-advisory
Sources
- CVE List CVE-2018-25125
- NVD CVE-2018-25125
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.