CVE-2026-82593
Received Received - Intake

Stack-Based Buffer Overflow in D-Link DIR-825M LTE Module Firmware

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82593
EUVD
EUVD-2026-68296

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
d-link dir-825m 1.1.8
d-link dir-825m to 1.1.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82593 is a stack-based buffer overflow in D-Link DIR-825M router firmware version 1.1.8. The flaw exists in the sub_41802C function which processes the fota_url parameter in the /boafrm/formLtefotaUpgradeFibocom endpoint. Attackers can exploit this by sending maliciously crafted HTTP POST requests with oversized parameters or command injection payloads, leading to arbitrary code execution with root privileges or denial of service.

Detection Guidance

To detect this vulnerability, check if your D-Link DIR-825M router is running firmware version v1.1.12 or earlier. Inspect network traffic for HTTP POST requests to the /boafrm/formLtefotaUpgradeFibocom endpoint with suspicious fota_url parameters containing shell control characters like semicolons, ampersands, or pipes. Use tools like Wireshark to capture and analyze traffic for malformed requests.

Commands to check firmware version: login to router admin panel or use telnet/SSH if enabled. For network scanning, use nmap to identify open ports and vulnerable endpoints. Example: nmap -p 80,443 <router-ip> to check web interface access.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your router with administrative privileges. An attacker could take control of your network traffic, install malware, monitor your internet activity, or use your router as part of a botnet. The device may also crash due to memory corruption, disrupting internet connectivity.

Mitigation Strategies

Immediately update the D-Link DIR-825M router to the latest firmware version if an update is available. Disable remote administration features if not required. Block external access to the web interface by configuring firewall rules to restrict access to the router's IP address.

If no patch is available, consider replacing the device with a supported model. Monitor network traffic for unusual activity targeting the vulnerable endpoint. Temporarily disable the LTE Module Firmware Upgrade feature if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart