D-Link DIR-825M EUVD-2026-68295

Low-privilege authentication to the DIR-825M web management interface is required, confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not possible per the available data. The attacker must reach the /boafrm/formDiskFormat endpoint over the network (AV:N); by default this is the LAN-side interface, so WAN exploitation is only possible if remote management is explicitly enabled. The disk formatting handler implies the router's USB/external storage feature must be present in the firmware build and the endpoint must be reachable. Exploitation is concretely limited by: (1) minimum low-privilege router credentials required, ruling out drive-by unauthenticated attacks; (2) LAN-only access by default unless remote management is enabled; (3) confirmed only for firmware version 1.1.8 - other versions are unconfirmed. No specific non-default configuration setting beyond the above is identified as a prerequisite in the available description.

The CVSS 4.0 score of 8.6 with full vulnerable-system and subsequent-system impact metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) accurately captures the severity ceiling: complete router compromise with lateral impact on LAN-attached devices. The exploit-public modifier (E:P) removes any obscurity barrier and signals that weaponization is already underway or imminent. No EPSS score was provided in the input, precluding a probabilistic exploitation-frequency estimate - this is a gap in the available intelligence. The absence from CISA KEV suggests mass exploitation has not yet been confirmed, but the public POC narrows that window considerably. The PR:L authentication requirement is the primary exploitation brake: attackers must hold at least low-level router credentials, which on consumer devices is frequently satisfied by default or weak password reuse. The scope-change signals (SC/SI/SA:H) are credible - a compromised gateway router can intercept, redirect, or deny traffic for all downstream hosts, meaning blast radius extends well beyond the device itself.

An attacker who has obtained low-privilege credentials to the DIR-825M's web management interface - for example, through default credentials or password reuse - sends a crafted HTTP POST request to /boafrm/formDiskFormat with an oversized partition parameter value. The sub_46725C function copies the value into a fixed-size stack buffer without bounds validation, overwriting the saved return address and enabling control-flow hijacking. Given the public POC and the typical absence of stack canaries or ASLR in embedded router firmware, reliable code execution as root on the device is achievable.