Overview
A high-severity buffer overflow vulnerability, identified as CVE-2025-13550, has been discovered in specific versions of D-Link routers. This vulnerability affects the D-Link DIR-822K and DWR-M920 models. Successful exploitation of this flaw could allow a remote attacker to execute arbitrary code on the affected device.
Technical Details
The vulnerability exists in the /boafrm/formVpnConfigSetup file. By manipulating the submit-url argument, an attacker can trigger a buffer overflow. The affected firmware versions are 1.00_20250513164613 for DIR-822K and 1.1.50 for DWR-M920. The exploit for this vulnerability has been publicly disclosed, increasing the risk of malicious exploitation.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-13550 is 8.8 (HIGH).
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality Impact: High (C:H)
- Integrity Impact: High (I:H)
- Availability Impact: High (A:H)
Possible Impact
Successful exploitation of CVE-2025-13550 can lead to:
- Remote Code Execution (RCE): An attacker could execute arbitrary code on the router, potentially gaining full control of the device.
- Denial of Service (DoS): The router could become unresponsive, disrupting network connectivity.
- Data Theft: Sensitive information stored on or transmitted through the router could be compromised.
- Network Compromise: The compromised router could be used as a pivot point to attack other devices on the network.
Mitigation and Patch Steps
To mitigate the risk posed by CVE-2025-13550, users are advised to take the following steps:
- Check Your Firmware Version: Verify the firmware version of your D-Link DIR-822K or DWR-M920 router. If you are using version 1.00_20250513164613 (DIR-822K) or 1.1.50 (DWR-M920), you are vulnerable.
- Apply the Patch: Visit the D-Link support website to check for a firmware update that addresses this vulnerability. Install the latest available firmware immediately.
- Disable Remote Management: If possible, disable remote management access to your router to reduce the attack surface.
- Use Strong Passwords: Ensure you are using a strong and unique password for your router’s administration interface.
- Monitor Network Activity: Keep an eye on your network activity for any suspicious behavior.
