Is CVE-2026-82593 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82593 being exploited in the wild.

How severe is CVE-2026-82593?

Critical severity, with a CVSS score of 9.9, published 31 August 2026.

Which products and versions are affected?

D-Link DIR-825M 1.1.8 (affected); potentially 1.1.12 and prior versions.

Is there a fix for CVE-2026-82593?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82593 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82593?

Check whether you run D-Link DIR-825M at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82593: D-Link DIR-825M stack-based buffer overflow in LTE firmware upgrade

CVE-2026-82593 · Severity: critical · CVSS 9.9 · Published 2026-08-31

D-Link DIR-825M routers include an LTE module firmware upgrade feature that processes user-supplied URLs. A vulnerability in this feature allows an unauthenticated attacker to inject arbitrary commands or overflow a stack buffer, leading to remote code execution with root privileges. This can result in complete compromise of the router, unauthorized network access, and data interception.

Technologies: D-Link DIR-825M. Vendors: D-Link.

Quick answers

Is CVE-2026-82593 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82593 being exploited in the wild.
How severe is CVE-2026-82593?: Critical severity, with a CVSS score of 9.9, published 31 August 2026.
Which products and versions are affected?: D-Link DIR-825M 1.1.8 (affected); potentially 1.1.12 and prior versions.
Is there a fix for CVE-2026-82593?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82593 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82593?: Check whether you run D-Link DIR-825M at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack-based buffer overflow (CWE-121) combined with command injection (CWE-78) in the sub_41802C function of the /boafrm/formLtefotaUpgradeFibocom endpoint. The fota_url parameter is insufficiently validated using strstr, which performs substring search rather than anchoring to the start, allowing protocol validation bypass. The parameter is then formatted into a 512-byte fixed-size stack buffer using sprintf and passed directly to system() without sanitization of shell metacharacters. An attacker can exploit this remotely via HTTP POST to either overflow the buffer with oversized input to hijack execution flow, or inject shell operators (;, &, |) to execute arbitrary commands as root. The exploit has been publicly disclosed, and no patch information is currently available.

Affected products

D-Link DIR-825M 1.1.8 (affected); potentially 1.1.12 and prior versions

Timeline

2026-08-31: disclosed
exploited: Exploit code published; not confirmed to be exploited in wild

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.