Cyber Posture

CVE-2025-13547

HighPublic PoC

Published: 23 November 2025

Published
23 November 2025
Modified
02 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This affects an unknown part of the file /boafrm/formDdns. This manipulation of the argument submit-url causes memory corruption. The attack may be initiated remotely. The exploit has been published…

more

and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the specific memory corruption flaw in the /boafrm/formDdns handler through timely firmware patching for affected D-Link routers.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes the submit-url argument to prevent manipulation that triggers memory corruption in the DDNS form.

SI-16 Memory Protection good match
prevent

Implements runtime memory protections like ASLR and DEP to block exploitation of the memory corruption vulnerability even if input validation fails.

Security SummaryAI

CVE-2025-13547 is a memory corruption vulnerability (CWE-119) affecting D-Link DIR-822K and DWR-M920 routers on firmware versions 1.00_20250513164613 and 1.1.50. The flaw resides in an unknown part of the /boafrm/formDdns file, where manipulation of the "submit-url" argument triggers the corruption. Published on 2025-11-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential arbitrary code execution, data compromise, or denial of service on the affected device.

Advisories and further details are documented in references including GitHub issues at https://github.com/QIU-DIE/CVE/issues/30 and https://github.com/QIU-DIE/CVE/issues/42, as well as VulDB entries at https://vuldb.com/?ctiid.333314, https://vuldb.com/?id.333314, and https://vuldb.com/?submit.693758. A public exploit has been published and may be actively used.

Details

CWE(s)
CWE-119

Affected Products

dlink
dir-822k firmware
1.00_20250513164613
dlink
dwr-m920 firmware
1.1.50

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Memory corruption vulnerability in router web interface (/boafrm/formDdns) exploitable remotely with low privileges (PR:L, AV:N) for arbitrary code execution, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References