CVE-2025-13552
Published: 23 November 2025
Description
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote.…
more
The exploit has been released to the public and may be exploited.
Mitigating Controls (NIST 800-53 r5)AI
Directly validates manipulated inputs like the submit-url argument to prevent buffer overflow exploitation in the /boafrm/formWlEncrypt function.
Implements memory protections such as stack canaries or DEP to mitigate arbitrary code execution from buffer overflow vulnerabilities.
Requires timely flaw remediation through firmware updates for affected D-Link DIR-822K and DWR-M920 versions to eliminate the buffer overflow vulnerability.
Security SummaryAI
CVE-2025-13552 is a buffer overflow vulnerability (CWE-119, CWE-120) discovered in D-Link DIR-822K and DWR-M920 routers running firmware versions 1.00_20250513164613 and 1.1.50. The flaw affects an unknown function in the /boafrm/formWlEncrypt file and is triggered by manipulating the submit-url argument.
The vulnerability enables remote exploitation over the network with low attack complexity and requires low privileges (PR:L) but no user interaction (CVSS:3.1 score of 8.8; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with such access can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.
Advisories and details are available in references such as GitHub issues at https://github.com/QIU-DIE/CVE/issues/36 and https://github.com/QIU-DIE/CVE/issues/44, along with VulDB entries at https://vuldb.com/?ctiid.333319, https://vuldb.com/?id.333319, and https://vuldb.com/?submit.693803; no specific patches or mitigations are detailed in the disclosure.
An exploit for this vulnerability has been publicly released, indicating potential for active exploitation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow vulnerability in the web management interface (/boafrm/formWlEncrypt) of D-Link routers enables remote arbitrary code execution over the network, directly facilitating T1190: Exploit Public-Facing Application.