Executive brief
D-Link DIR-825M routers include an LTE module firmware upgrade feature that processes user-supplied URLs. A vulnerability in this feature allows an unauthenticated attacker to inject arbitrary commands or overflow a stack buffer, leading to remote code execution with root privileges. This can result in complete compromise of the router, unauthorized network access, and data interception.
Technical details
The vulnerability is a stack-based buffer overflow (CWE-121) combined with command injection (CWE-78) in the sub_41802C function of the /boafrm/formLtefotaUpgradeFibocom endpoint. The fota_url parameter is insufficiently validated using strstr, which performs substring search rather than anchoring to the start, allowing protocol validation bypass. The parameter is then formatted into a 512-byte fixed-size stack buffer using sprintf and passed directly to system() without sanitization of shell metacharacters. An attacker can exploit this remotely via HTTP POST to either overflow the buffer with oversized input to hijack execution flow, or inject shell operators (;, &, |) to execute arbitrary commands as root. The exploit has been publicly disclosed, and no patch information is currently available.
Affected products
- D-Link DIR-825M 1.1.8 (affected); potentially 1.1.12 and prior versions
Timeline
- 2026-08-31: disclosed
- exploited: Exploit code published; not confirmed to be exploited in wild