Cyber Posture

CVE-2025-13548

HighPublic PoC

Published: 23 November 2025

Published
23 November 2025
Modified
02 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFirewallAdv. Such manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been…

more

disclosed to the public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Validates the submit-url argument in the /boafrm/formFirewallAdv endpoint to prevent buffer overflow exploitation.

SI-16 Memory Protection good match
prevent

Implements memory protections like ASLR and DEP to mitigate arbitrary code execution from buffer overflows.

SI-2 Flaw Remediation good match
prevent

Requires timely flaw remediation through firmware patching to eliminate the buffer overflow vulnerability.

Security SummaryAI

CVE-2025-13548 is a buffer overflow vulnerability (CWE-119, CWE-120) in D-Link DIR-822K and DWR-M920 routers running firmware versions 1.00_20250513164613 and 1.1.50. The flaw affects unknown code in the /boafrm/formFirewallAdv file, where manipulation of the submit-url argument triggers the overflow. Published on 2025-11-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation by attackers with low privileges, such as authenticated users over the network, without requiring user interaction. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.

Advisories and references, including GitHub issues at QIU-DIE/CVE/31 and /43, and VulDB entries (ctiid.333315, id.333315, submit.693767), document the issue. The exploit has been publicly disclosed and may be used by attackers. No specific patch or mitigation details are provided in the available information.

Details

CWE(s)
CWE-119CWE-120

Affected Products

dlink
dir-822k firmware
1.00_20250513164613
dlink
dwr-m920 firmware
1.1.50

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Buffer overflow in the public-facing router web interface (/boafrm/formFirewallAdv) via remote manipulation of submit-url enables exploitation of public-facing applications (T1190), remote services (T1210), and application exploitation leading to DoS via crashes (T1499.004).

References