D-Link DIR-825 Wi-Fi Router

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Basic physical security. UART ports exposed on the PCB allow firmware extraction with basic tools. No tamper detection.
Known vulnerabilities	Very common	https://nvd.nist.gov/vuln/detail/CVE-2018-10562 🔗 Proof	Hundreds of CVEs documented, including unauthenticated remote code execution. CVE-2018-10561 and CVE-2018-10562 are critical flaws actively exploited in the wild.
Prior attacks	Very common	🔗 Proof	Primary target of Mirai botnet. Default credentials "admin" / "" (empty password) were in Mirai's built-in password list, infecting hundreds of thousands of units.
Updatability	None	🔗 Proof	D-Link has discontinued firmware updates for all DIR-825 hardware revisions. Known vulnerabilities remain unpatched on devices still in active use.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Web management interface requires password, but remote management is often enabled by default and exposed directly to the internet.
Communications	Encrypted with obselete encryption	🔗 Proof	HTTPS supported but uses outdated TLS 1.0/1.1 with weak ciphers. Most admin pages served over plain HTTP by default.
Storage	No encryption	🔗 Proof	Configuration files, admin passwords, and Wi-Fi keys stored in flash memory without encryption. Physical access allows full credential extraction.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Single admin account only. No role-based access control, no multi-user support.
Authentication	Basic	🔗 Proof	Password authentication only. No two-factor authentication support. Default credentials widely known.
Brute-force protection	Absent	🔗 Proof	No rate limiting or account lockout after failed login attempts. Brute-force attacks are trivial and automated.
Event logging	Partial logging	🔗 Proof	Basic system logs available but do not record detailed authentication events or admin action history.
Passwords	Default, common, easy to guess	🔗 Proof	Default credentials "admin" with empty password shipped on many units. Users are not forced to change default passwords during initial setup.
Category Score	Score: / 3

Technical Specifications

Property	Details
Operating System & App	(Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi, Ethernet
Physical (Dimensions & Mass)	Dimensions: • Mass: