CVE-2025-56565: DD-WRT firmware cleartext credential storage in NVRAM

CVE-2025-56565 · Severity: high · CVSS 7.6 · Published 2026-09-16

DD-WRT firmware used on TP-Link TL-WR740N wireless routers stores authentication credentials—including admin passwords, SSH keys, and third-party service credentials—unencrypted in the device's flash memory. An attacker with physical access to the router can read these credentials directly from the flash chip using commodity hardware, gaining full control of the device, network access, and accounts with external services. This is a significant risk for devices in unattended locations or hardware that changes hands without secure erasure.

Vendors: TP-Link.

Quick answers

Is CVE-2025-56565 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-56565 being exploited in the wild.
How severe is CVE-2025-56565?
High severity, with a CVSS score of 7.6, published 16 September 2026.
Which products and versions are affected?
DD-WRT firmware all builds for TP-Link TL-WR740N v1, v2, v3, and v4; TP-Link TL-WR740N v1, v2, v3, v4.
Is there a fix for CVE-2025-56565?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-56565 attacked?
It is attacked with physical access, in device firmware.
Am I affected by CVE-2025-56565?
Check whether you run DD-WRT firmware or TP-Link TL-WR740N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cleartext storage flaw (CWE-312, CWE-316) in the NVRAM configuration store used by DD-WRT firmware. Sensitive credentials—including SSH private keys, dynamic DNS passwords, email notification accounts, and administrative passwords—are written to the SPI flash memory without encryption or obfuscation. An attacker with physical access can extract the entire flash contents using an SPI programmer (e.g., CH341A) and recover plaintext credential strings without authentication or device power-on. No administrative password knowledge is required, and the extraction leaves no device logs. The recovered credentials may grant access to external systems and services beyond the router itself, including SSH-protected infrastructure and third-party accounts.

Affected products

  • DD-WRT DD-WRT firmware all builds for TP-Link TL-WR740N v1, v2, v3, and v4
  • TP-Link TL-WR740N v1, v2, v3, v4

Timeline

  • 2025-07-28: disclosed: Vulnerability discovered
  • 2025-08-01: other: Technical validation completed
  • 2025-08-02: other: Vendor notified (security@dd-wrt.com)
  • 2025-08-28: other: CVE ID assigned by MITRE
  • 2026-08-14: advisory: Public disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.