D-Link DIR-825M CVE-2026-7288

Requires valid authentication credentials to the D-Link DIR-825M web administration interface (PR:L in CVSS vector). The vulnerable VPN configuration functionality at /boafrm/formVpnConfigSetup must be accessible to the authenticated user role - typically available to standard administrator accounts on consumer routers. Attack is delivered via network (AV:N), meaning the web interface must be reachable by the attacker either from the LAN segment or WAN if remote management is enabled. No user interaction required beyond the attacker's own authenticated session (UI:N). Exploitation is NOT possible against devices with: (1) remote management disabled and attacker located on WAN, (2) non-default strong credentials preventing initial authentication, or (3) web interface access restricted by firewall rules. The attack targets specifically firmware version 1.1.12 - other versions may have different memory layouts affecting exploit reliability.

Real-world risk is MODERATE-HIGH despite 7.4 CVSS score. Attack complexity is low (AC:L) and requires only authenticated access (PR:L), which is concerning given widespread credential stuffing attacks and default password reuse on consumer routers. Public exploit availability (E:P confirmed by GitHub disclosure) significantly lowers the barrier to exploitation. However, PR:L requirement means unauthenticated internet attackers cannot directly exploit this without first compromising credentials through separate means (brute force, default credentials, social engineering). No CISA KEV listing or EPSS data provided suggests limited observed exploitation in the wild currently. The high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) with scope unchanged (SC:N) indicates full router compromise but not lateral network movement without additional steps. Primary risk applies to: (1) devices with exposed management interfaces on WAN, (2) environments with weak/default admin passwords, (3) insider threat scenarios. CRITICAL GAP: No patch availability data or vendor security bulletin reference provided - remediation path unclear beyond device replacement.

An attacker with valid low-privilege credentials (potentially obtained via credential stuffing, default password lists, or phishing) authenticates to the DIR-825M web interface remotely. They navigate to the VPN configuration page at /boafrm/formVpnConfigSetup and submit a specially crafted HTTP POST request containing an oversized submit-url parameter value exceeding the fixed buffer size in function sub_4151FC. The buffer overflow overwrites adjacent stack memory including return addresses, allowing the attacker to redirect execution flow to injected shellcode. With successful exploitation, the attacker gains arbitrary code execution at the privilege level of the web server process (typically root on embedded devices), enabling full device compromise, firewall rule modification, traffic interception, or use of the router as a pivot point for internal network attacks.