CVE-2025-13552
📋 TL;DR
A buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers allows remote attackers to execute arbitrary code by manipulating the submit-url parameter in the /boafrm/formWlEncrypt endpoint. This affects users running firmware version 1.00_20250513164613/1.1.50. The exploit is publicly available and can be triggered without authentication.
💻 Affected Systems
- D-Link DIR-822K
- D-Link DWR-M920
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Device takeover enabling network traffic interception, credential theft, and lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists; manipulation of submit-url parameter triggers buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: Yes
Instructions:
1. Monitor D-Link security advisories for firmware updates. 2. Download and install patched firmware when available. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable WAN access to web interface
allPrevent external exploitation by blocking access to router management interface from internet.
Configure firewall to block inbound traffic to port 80/443 on WAN interface
Network segmentation
allIsolate affected routers in separate VLAN to limit lateral movement.
vlan 100
interface vlan 100
ip address 10.0.100.1 255.255.255.0
🧯 If You Can't Patch
- Replace affected devices with patched alternatives
- Implement strict network access controls to limit device exposure
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: Login > Status > Firmware VersionCheck Version:
curl -s http://router-ip/status.cgi | grep firmwareVerify Fix Applied:
Verify firmware version is updated beyond 1.00_20250513164613/1.1.50📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formWlEncrypt
- Multiple failed buffer overflow attempts in system logs
Network Indicators:
- Abnormal traffic patterns to router management interface
- Exploit-specific payloads in HTTP requests
SIEM Query:
source="router.log" AND (uri="/boafrm/formWlEncrypt" OR "submit-url" AND length>100)🔗 References
- https://github.com/QIU-DIE/CVE/issues/36
- https://github.com/QIU-DIE/CVE/issues/44
- https://vuldb.com/?ctiid.333319
- https://vuldb.com/?id.333319
- https://vuldb.com/?submit.693803
- https://vuldb.com/?submit.695434
- https://www.dlink.com/
- https://github.com/QIU-DIE/CVE/issues/36
- https://github.com/QIU-DIE/CVE/issues/44
