Description

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-30T23:17:08.303Z",
  "pubdate": "2026-08-30T23:17:08.303Z",
  "executiveSummary": "The D-Link DIR-825M version 1.1.8 contains a critical stack-based buffer overflow vulnerability located within the /boafrm/formDiskFormat endpoint. This flaw allows a remote, unauthenticated attacker to inject malicious data into the stack via the 'partition' argument, potentially leading to arbitrary code execution. The vulnerability resides in the function sub_46725C, which fails to properly validate the length of user-supplied input before copying it into a fixed-size stack buffer. Successful exploitation can result in a full compromise of the device, allowing the attacker to execute unauthorized commands with the privileges of the underlying web server process. Given that the exploit vector is remote and public, the risk to affected devices is severe, as it enables full control of the device's firmware operations without requiring prior authentication.",
  "technicalDetails": "The vulnerability is identified as a classic stack-based buffer overflow occurring during the processing of HTTP POST requests directed at the Disk Formatting Handler component. The root cause is located in the function sub_46725C within the binary responsible for handling the /boafrm/formDiskFormat URI.\nDuring the processing of the 'partition' parameter, the application utilizes unsafe memory copy functions that do not perform adequate bounds checking on the input buffer. When a specially crafted string exceeding the allocated stack space for the variable is submitted to the partition parameter, the input overflows the destination buffer and continues into adjacent memory regions on the stack.\nThe attack flow proceeds as follows: An attacker sends a malicious HTTP request to the /boafrm/formDiskFormat endpoint with an overly long 'partition' argument. The function sub_46725C attempts to parse or copy this input into a local buffer. Because the length of the input is not sanitized or restricted, the excess data overwrites critical stack metadata, including the saved frame pointer and the return address. Upon the function's completion, the processor attempts to return execution to the address stored on the stack, which the attacker has now redirected to a controlled memory location or a malicious payload (e.g., shellcode).\nExploitation requires network access to the device's management interface. Because the vulnerability exists within the web server's request handling logic, it is accessible remotely and does not require valid administrative credentials. The impact of successful exploitation is the ability to execute arbitrary machine code with the same privileges as the boa web server. Depending on the environment, this typically results in full system control, persistence, or the ability to reconfigure the device for man-in-the-middle or data exfiltration attacks. The lack of stack canaries or other modern exploit mitigation techniques in the firmware binary facilitates the successful redirection of the instruction pointer."
}