CVE-2026-7289
Remote Buffer Overflow in D-Link DIR-825M WAN Setup Function
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-825m_firmware | 1.1.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the D-Link DIR-825M router firmware version 1.1.12, specifically in the function sub_414BA8 within the /boafrm/formWanConfigSetup endpoint.
It arises because the function uses the unsafe strcpy function to copy the "submit-url" parameter from incoming HTTP requests into a fixed-size buffer without checking the length.
An attacker can send an excessively long "submit-url" value, causing a stack-based buffer overflow by overwriting adjacent memory on the stack.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several serious impacts.
- Denial of Service (DoS) by crashing the router's web server process, making the management interface inaccessible.
- Arbitrary code execution by overwriting the return address on the stack, allowing an attacker to run malicious code.
- Full device compromise, enabling the attacker to control the router, monitor network traffic, or use the device as a pivot point for further attacks.
The attack can be performed remotely without authentication by sending a specially crafted HTTP POST request.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the `/boafrm/formWanConfigSetup` endpoint with an excessively long "submit-url" parameter. The presence of the vulnerability is confirmed if the router's web server process crashes or behaves unexpectedly.
A proof of concept involves using tools like Burp Repeater to send such a request.
- Use curl or similar tools to send a POST request with a very long "submit-url" parameter to http://<router-ip>/boafrm/formWanConfigSetup.
- Example curl command: curl -X POST -d "submit-url=$(python3 -c 'print("A"*1000)')" http://<router-ip>/boafrm/formWanConfigSetup
- Monitor the router for crashes or unresponsiveness after sending the request.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the router's management interface to trusted networks only, such as limiting access via firewall rules or network segmentation.
Avoid exposing the vulnerable endpoint to the internet or untrusted networks.
Monitor the router for unusual behavior or crashes that may indicate exploitation attempts.
If available, apply firmware updates or patches provided by the vendor to fix the buffer overflow vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to execute arbitrary code on the affected D-Link DIR-825M router, potentially leading to full device compromise. This could enable unauthorized access to network traffic and sensitive data passing through the device.
Such unauthorized access and control over network infrastructure could result in violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, exploitation of this vulnerability may lead to non-compliance with these standards due to potential data breaches and failure to maintain adequate security controls.