Introduction
Remote attackers can take full control of D-Link DIR-822K and DWR-M920 routers through a critical memory corruption flaw in the web interface. Public exploit code is already available, so unpatched devices are at immediate risk of compromise and persistent network intrusion.
D-Link is a major networking hardware vendor with millions of devices deployed worldwide. Its DIR and DWR series routers are common in homes and small businesses, so a flaw in them affects individual users and organizations alike.
Technical Information
CVE-2025-13547 is a stack-based buffer overflow in the /boafrm/formDdns endpoint of D-Link DIR-822K and DWR-M920 routers running firmware version 1.00_20250513164613 or 1.1.50. An attacker triggers it by sending an HTTP request with a submit-url parameter whose value exceeds the allocated buffer size. The firmware copies that value into a fixed-size stack buffer without proper bounds checking, and memory is corrupted.
The root cause is improper input validation of the submit-url parameter. The vulnerable code does not check the length of the user-supplied value before copying it to the stack. An attacker can therefore overwrite adjacent memory, including function return addresses or control data, which can lead to arbitrary code execution or denial of service. The vulnerability is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer).
Exploitation requires no authentication. Any remote attacker with network access to the router's web interface can send a malicious request to /boafrm/formDdns and trigger the overflow. Public exploit code is available and can be used to automate attacks.
Affected Systems and Versions
- D-Link DIR-822K, firmware version 1.00_20250513164613 and earlier
- D-Link DWR-M920, firmware version 1.1.50 and earlier
On all of these versions, the attack goes through the submit-url parameter of the /boafrm/formDdns endpoint.
Vendor Security History
D-Link has a history of buffer overflow and remote code execution vulnerabilities in its router firmware, including CVE-2020-29557 and multiple buffer overflow issues disclosed in 2024 and 2025. Patch response times have varied, and end-of-life policies often leave older devices without security updates. The DIR-822K reached end of support in February 2023 and will not receive further patches.
