CVE-2026-7288
Buffer Overflow in D-Link DIR-825M VPN Config Allows Remote Exploit
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-825m_firmware | 1.1.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-7288 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-7288 is a critical buffer overflow vulnerability found in the D-Link DIR-825m router running firmware version 1.1.12. It occurs in the function sub_4151FC within the /boafrm/formVpnConfigSetup endpoint. The vulnerability arises because the function uses the unsafe strcpy function to copy the "submit-url" parameter from incoming HTTP requests into a fixed-size buffer without checking the length of the input.
An attacker can exploit this by sending an excessively long "submit-url" parameter, which causes a buffer overflow by overwriting adjacent stack memory. This can lead to denial of service (crashing the router's management interface) or potentially allow arbitrary code execution, enabling full compromise of the router.
How can this vulnerability impact me? :
Exploitation of this vulnerability can have severe impacts including denial of service (DoS) by crashing the router's web server process, making the management interface inaccessible.
More critically, it can allow an attacker to execute arbitrary code remotely without authentication. This could lead to full compromise of the router, enabling the attacker to monitor network traffic, manipulate network configurations, or use the device as a pivot point to launch further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the "/boafrm/formVpnConfigSetup" endpoint containing an unusually long or oversized "submit-url" parameter.
A practical detection method involves capturing and inspecting HTTP traffic to identify such crafted requests that attempt to exploit the buffer overflow.
For example, using network traffic analysis tools like tcpdump or Wireshark, you can filter HTTP POST requests to the vulnerable endpoint.
- tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/boafrm/formVpnConfigSetup'
- Use curl or similar tools to manually test by sending a crafted POST request with a large "submit-url" parameter to see if the device responds abnormally or crashes.
- Example curl command to test the vulnerability: curl -X POST http://<router-ip>/boafrm/formVpnConfigSetup -d 'submit-url='$(python3 -c 'print("A"*1000)')
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable router's management interface to trusted networks only, such as local LAN or VPN.
Disable remote management features if enabled to prevent attackers from sending malicious requests remotely.
Monitor the device for unusual crashes or reboots that may indicate exploitation attempts.
If available, update the router firmware to a version that patches this vulnerability or contact the vendor for a security update.
As a temporary workaround, implement network-level filtering or firewall rules to block HTTP POST requests to the "/boafrm/formVpnConfigSetup" endpoint.