Quick Look: CVE-2026-7288 Buffer Overflow in D-Link DIR-825M Router with Public Exploit Available

Introduction

A publicly available exploit for a buffer overflow in the D-Link DIR-825M router's VPN configuration handler gives remote attackers a straightforward path to arbitrary code execution on affected devices. With a CVSS 3.1 score of 8.8 and no vendor patch currently available, the vulnerability is a concrete risk for any network still running the DIR-825M. Mirai botnet variants also have a well-established pattern of adding D-Link router exploits to their arsenals.

Technical Information

The vulnerability is in the web management interface of the D-Link DIR-825M running firmware version 1.1.12. The function sub_4151FC handles HTTP POST requests sent to the /boafrm/formVpnConfigSetup endpoint. When it processes the submit-url parameter from an incoming request, it copies the value into a fixed-size stack buffer with strcpy, which does no bounds checking on the input length.

This is a textbook stack-based buffer overflow. An attacker who supplies an oversized value for the submit-url parameter overwrites adjacent stack memory, including the saved return address. With a carefully built overflow payload, the attacker can redirect program execution to shellcode of their choosing and run arbitrary code on the device.

The NVD classifies this under two CWE categories:

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120: Buffer Copy without Checking Size of Input

Attack Flow

The attacker identifies a D-Link DIR-825M device with firmware version 1.1.12 exposed on the network.
The attacker crafts an HTTP POST request targeting the /boafrm/formVpnConfigSetup endpoint.
The request includes an excessively long string in the submit-url parameter, built to overflow the fixed-size stack buffer in sub_4151FC.
The strcpy call copies the oversized input without bounds checking and overwrites the return address on the stack.
When the function returns, execution jumps to the attacker-controlled address, and the attacker can run arbitrary code.

Severity Metrics

Metric System	Base Score	Key Details
CVSS 3.1	8.8 High	Network vector, low complexity, low privileges required, no user interaction, high impact across confidentiality, integrity, and availability
CVSS 4.0	7.4 High	Includes E:P (Exploit Public) temporal modifier
CVSS 2.0	9.0 High	Complete compromise under legacy scoring

Authentication Ambiguity

The NVD CVSS vectors list low privileges (PR:L) or single authentication (Au:S) as prerequisites. The security researcher who published the exploit, however, states that the vulnerability can be triggered without authentication. The published exploit code does include a webuicookie header, which suggests some session state may be involved. Defenders should assume that minimal or no authentication is required.

Affected Systems and Versions

Product: D-Link DIR-825M
Hardware Revision: Ax (Non US)
Firmware Version: 1.1.12 (and firmware versions 1.xx or earlier per D-Link advisory SAP10477)
Vulnerable Endpoint: /boafrm/formVpnConfigSetup
Vulnerable Function: sub_4151FC

Any D-Link DIR-825M device running the affected firmware with the web management interface reachable over the network is potentially exploitable.

Vendor Security History

D-Link has a long record of security incidents, and that record bears on how much risk its products carry.

Year	Incident
2013	Firmware for the DIR-100 revA contained a backdoor that bypassed authentication via a specific user agent string
2015	ZynOS firmware in some D-Link routers was vulnerable to DNS hijacking by unauthenticated remote attackers
2017	The FTC sued D-Link for failing to secure routers and IP cameras, and the case settled in 2019 with mandatory security program enhancements
2023	D-Link confirmed a data breach after an employee fell victim to a phishing attack

The DIR-825 product family in particular has a pattern of stack-based buffer overflows:

CVE	Date	Component
CVE-2025-6291	June 2025	HTTP POST Request do_file
CVE-2025-7206	July 2025	httpd switch_language.cgi
CVE-2025-8949	August 2025	httpd ping_response.cgi
CVE-2025-10666	September 2025	apply.cgi sub_4106d4

The repeated memory-safety issues in the web management interface suggest systemic weaknesses in the DIR-825 firmware codebase that have not been addressed at an architectural level.

CVE Analysis

Experimental AI-Generated Content

Introduction