D-Link DIR-825M CVE-2026-82593

The attacker must have network access to the DIR-825M's web administration interface and must authenticate with at least low-privilege credentials (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by the available CVSS data. The Fibocom LTE module must be present and the FOTA upgrade feature accessible (i.e., the /boafrm/formLtefotaUpgradeFibocom endpoint must be reachable and functional). No user interaction is required beyond the attacker's own crafted request. Exploitation is limited by: (1) the requirement for valid router credentials, reducing exposure from open internet mass-scanning; (2) the product's deployment primarily in consumer/SOHO environments rather than enterprise infrastructure; and (3) the need for access to the LTE-enabled variant specifically. No special OS-level conditions, non-default router configuration settings, or specific geographic region restrictions have been identified as additional prerequisites.

The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity flaw requiring only low-privilege credentials, with high impact on both the router and the attached LTE module. A public PoC exploit exists (GitHub, Robots10/IoT_vlu), directly corroborating the E:P (proof-of-concept) CVSS 4.0 supplemental metric, which elevates practical risk above the theoretical base score. CISA KEV status is not confirmed; exploitation has not been verified as active in the wild. EPSS data was not provided in the intelligence input, so probabilistic exploitation likelihood cannot be quantified beyond the available signals. The PR:L requirement (low-privilege authentication) provides a meaningful, if modest, barrier - the attacker must possess valid credentials to the router's web interface, which limits opportunistic mass exploitation but not targeted attacks against default or weak credentials. The combination of a published PoC, high-impact CVSS metrics, and no available vendor patch makes this a genuine priority for operators of this router model.

An attacker with low-privilege credentials to the DIR-825M web interface (e.g., obtained via default credentials or credential stuffing) sends a crafted HTTP POST request to /boafrm/formLtefotaUpgradeFibocom with an oversized fota_url value. The value overflows the stack buffer in sub_41802C, overwriting the return address and redirecting execution to attacker-controlled code running with the privilege of the web server process. A public PoC demonstrates this technique and reduces attack complexity to script-kiddie level.