Quick Look: CVE-2026-7289 Remote Buffer Overflow in D-Link DIR-825M Router

Introduction

A publicly disclosed buffer overflow in the D-Link DIR-825M router allows unauthenticated remote attackers to crash or fully compromise the device with a single HTTP request. The flaw has a CVSS score of 8.8, and exploit code is already available on GitHub. Any DIR-825M with firmware version 1.1.12 that exposes its web management interface is at immediate risk of takeover. A compromised router could then give an attacker a foothold for network interception, lateral movement, or botnet recruitment.

Technical Information

The vulnerability is in the sub_414BA8 function, which handles HTTP requests to the /boafrm/formWanConfigSetup endpoint on the D-Link DIR-825M router running firmware version 1.1.12. While processing a request, this function reads the submit-url parameter from the HTTP POST body and copies it into a fixed-size buffer on the stack with strcpy. strcpy does no bounds checking at all, so a value longer than the allocated buffer overwrites adjacent stack memory, including the saved return address.

The root cause is a call to strcpy with no prior check on the input length. The flaw is classified under both CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).

Attack Flow

The attacker needs no authentication and can carry out the whole attack over the network:

1. The attacker finds a D-Link DIR-825M router with its web management interface reachable (either on the LAN or, if remote management is enabled, from the WAN).
2. The attacker sends an HTTP POST request to /boafrm/formWanConfigSetup with an excessively long string in the submit-url parameter.
3. The sub_414BA8 function processes the request and calls strcpy to copy the oversized submit-url value into a fixed-size stack buffer.
4. The copy overflows the buffer and overwrites adjacent stack data, including the return address.
5. Depending on the payload, the result is either a crash of the web server process (denial of service) or a jump to attacker-controlled shellcode (arbitrary code execution, which gives the attacker full control of the router).

Pattern of Similar Vulnerabilities

The same kind of input validation failure appears in other D-Link boafrm endpoints on the DIR-825M:

The repeated issues point to a systemic lack of bounds checking across the device's web management interface. Other boafrm handlers may contain undiscovered vulnerabilities of the same kind.

Affected Systems and Versions

The confirmed affected configuration is:

• Product: D-Link DIR-825M
• Firmware Version: 1.1.12
• Vulnerable Endpoint: /boafrm/formWanConfigSetup
• Vulnerable Function: sub_414BA8
• Vulnerable Parameter: submit-url

The available information does not confirm whether other DIR-825M firmware versions are affected or unaffected. Because the input validation issues in the boafrm handlers are systemic, other versions may also be vulnerable.

Vendor Security History

D-Link has a well-documented record of security issues in its SOHO router product lines. The DIR-825M alone has had multiple buffer overflow disclosures in recent months, including CVE-2025-13305 (buffer overflow in /boafrm/formTracerouteDiagnosticRun) and CVE-2025-13304 (buffer overflow in /boafrm/formPingDiagnosticRun). All three vulnerabilities share the same root cause, which is unbounded string copying in HTTP parameter handling.

Outside the DIR-825M, D-Link has faced active zero-day exploitation campaigns against discontinued legacy DSL gateways under CVE-2026-0625. The company stated explicitly that it would release no patches for those devices. If D-Link classifies the DIR-825M v1.1.12 as End of Life, the same could happen here, and users would have no remediation path other than replacing the hardware.

References

• CVE-2026-7289 on NVD
• D-Link DIR-825M Buffer Overflow PoC (GitHub)
• VulDB Submission #803025
• VulDB Entry #359947
• VulDB CTI for #359947
• D-Link Official Website
• D-Link Technical Support
• CVE-2025-13305: D-Link DIR-825M Buffer Overflow (SentinelOne)
• CVE-2025-13304 on NVD
• Hackers Exploit Zero Day in Discontinued D-Link Devices (SecurityWeek)
• CISA Home Network Security Guidance