Executive brief
The D-Link DIR-825M router's disk formatting feature contains a critical vulnerability that allows remote attackers to execute arbitrary commands with root privileges. An unauthenticated attacker can send a specially crafted request to the formatting endpoint to overflow the router's memory, crash the device, or take complete control of the system. This compromises the security of any network protected by the affected router.
Technical details
The vulnerability is a stack-based buffer overflow (CWE-121) combined with command injection (CWE-78) in the sub_46725C function of the /boafrm/formDiskFormat endpoint. The vulnerable code retrieves a user-controlled partition parameter from HTTP POST requests and passes it directly to sprintf() into a 132-byte stack buffer without any validation, length checks, or sanitization. An attacker can exploit this by sending either an oversized string to trigger buffer overflow and control flow hijacking, or by injecting shell metacharacters (e.g., semicolons, ampersands, pipes) to execute arbitrary system commands via system() with root privileges. The vulnerability is remotely exploitable without authentication, and a public exploit is available. No patch status is currently documented.
Affected products
- D-Link DIR-825M 1.1.8
Timeline
- 2026-08-30: disclosed
- exploited: Public exploit available