Overview
A high-severity buffer overflow vulnerability, identified as CVE-2025-13551, has been discovered in D-Link DIR-822K and DWR-M920 routers. This vulnerability allows remote attackers to potentially execute arbitrary code on affected devices. Given the availability of public exploits, immediate action is recommended.
Technical Details
The vulnerability resides in the /boafrm/formWanConfigSetup file within the router’s firmware. Specifically, the submit-url argument is susceptible to a buffer overflow when manipulated with excessively long input. An attacker can exploit this flaw by sending a crafted request to the router, potentially overwriting memory and gaining control of the device.
Affected Products:
- D-Link DIR-822K 1.00_20250513164613
- D-Link DWR-M920 1.1.50
The vulnerability is remotely exploitable, making it a significant threat to users of these router models.
CVSS Analysis
The vulnerability has been assigned a CVSS score of 8.8 (HIGH), indicating a critical risk level.
- CVSS Vector: (Calculated CVSS Vector will be available on NVD once published – Example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality Impact: High (C:H)
- Integrity Impact: High (I:H)
- Availability Impact: High (A:H)
This high score reflects the ease of exploitation and the potential for significant impact on affected systems.
Possible Impact
Successful exploitation of this vulnerability can lead to:
- Remote Code Execution (RCE): Attackers can execute arbitrary code on the router, potentially gaining complete control.
- Data Breach: Sensitive information stored on the router or transmitted through it could be compromised.
- Denial of Service (DoS): The router could be rendered unusable, disrupting network connectivity.
- Malware Infection: The router could be used as a platform to spread malware to other devices on the network.
- Botnet Recruitment: Compromised routers can be incorporated into botnets for malicious activities.
Mitigation and Patch Steps
The following steps are recommended to mitigate the risk of this vulnerability:
- Check Firmware Version: Verify the firmware version of your D-Link DIR-822K or DWR-M920 router. If you are using version 1.00_20250513164613 (DIR-822K) or 1.1.50 (DWR-M920), you are likely vulnerable.
- Apply Firmware Update: Visit the D-Link website and download the latest firmware update for your router model. Follow the instructions provided by D-Link to install the update. D-Link should have a security advisory and patched firmware available soon. Keep checking their website.
- Disable Remote Management: If possible, disable remote management access to your router. This can reduce the attack surface.
- Strong Passwords: Ensure you are using strong, unique passwords for your router’s administration interface and Wi-Fi network.
- Monitor Network Traffic: Monitor your network traffic for any suspicious activity.
- Consider Alternative Routers: If a patch is not available or you are unable to apply it, consider replacing the vulnerable router with a more secure model.
