Overview
A high-severity security vulnerability, identified as CVE-2025-13552, has been discovered in D-Link DIR-822K and DWR-M920 routers. This flaw allows remote attackers to execute arbitrary code due to a buffer overflow in the /boafrm/formWlEncrypt function when handling the submit-url argument. The exploit has been publicly released, increasing the risk of active exploitation.
Technical Details
The vulnerability resides within an unspecified function of the /boafrm/formWlEncrypt file in D-Link DIR-822K and DWR-M920 routers, specifically versions 1.00_20250513164613 (DIR-822K) and 1.1.50 (DWR-M920). By manipulating the submit-url argument, an attacker can trigger a buffer overflow. The nature of the overflow allows for remote code execution, potentially granting the attacker complete control of the affected device.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-13552 is 8.8 (HIGH). This high score reflects the following factors:
- Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
- Attack Complexity: Low (AC:L) – Exploitation requires minimal skill or resources.
- Privileges Required: None (PR:N) – No prior authentication is required.
- User Interaction: None (UI:N) – No user interaction is needed to trigger the vulnerability.
- Scope: Unchanged (S:U) – The vulnerability impacts only the affected resource.
- Confidentiality Impact: High (C:H) – An attacker can gain access to sensitive information.
- Integrity Impact: High (I:H) – An attacker can modify system data or execute arbitrary code.
- Availability Impact: High (A:H) – An attacker can cause a denial-of-service condition.
Possible Impact
Successful exploitation of CVE-2025-13552 can have severe consequences:
- Complete Device Compromise: An attacker can gain full control of the affected D-Link router.
- Data Theft: Sensitive data transmitted through the router, such as login credentials or personal information, could be compromised.
- Network Disruption: The attacker could use the compromised router to launch further attacks against other devices on the network or to disrupt network services.
- Botnet Recruitment: Compromised routers can be incorporated into botnets for malicious activities.
Mitigation and Patch Steps
To mitigate the risk posed by CVE-2025-13552, users of D-Link DIR-822K and DWR-M920 routers are strongly advised to take the following steps:
- Check for Firmware Updates: Visit the official D-Link website to check for available firmware updates for your specific router model. Apply the latest firmware as soon as possible.
- Disable Remote Management: If not required, disable remote management access to your router.
- Strong Password: Ensure you have a strong and unique password for your router’s administration interface.
- Network Segmentation: Consider segmenting your network to limit the impact of a potential compromise.
- Monitor Network Traffic: Monitor your network for suspicious activity.
