Description

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T00:16:41.630Z",
  "pubdate": "2026-08-31T00:16:41.630Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in the D-Link DIR-825M router, specifically within the LTE Module Firmware Upgrade component. The vulnerability resides in the /boafrm/formLtefotaUpgradeFibocom handler, triggered by improper input validation of the fota_url argument. This flaw allows a remote, unauthenticated attacker to inject malicious payloads into the stack, leading to arbitrary code execution, potential system compromise, and denial-of-service conditions. Given the availability of public exploit material, the risk to affected devices is high, as the vulnerability facilitates remote exploitation without requiring local access or pre-existing user credentials. Immediate remediation is required to prevent unauthorized control of the network device.",
  "technicalDetails": "The vulnerability is located within the sub_41802C function of the binary /boafrm/formLtefotaUpgradeFibocom, which is responsible for processing requests related to the LTE module firmware over-the-air (FOTA) upgrade process. The flaw is fundamentally a classic stack-based buffer overflow caused by an insecure memory copy operation.\nDuring the processing of the fota_url argument, the application fails to perform adequate bounds checking before copying the user-supplied string into a fixed-size stack buffer. An attacker can craft a malicious HTTP request containing an excessively long fota_url value. When the function processes this input, the overflow overwrites the adjacent memory on the stack, including critical control data such as the saved return address or function pointers.\nThe attack flow proceeds as follows: First, the attacker sends a crafted POST request to the targeted endpoint /boafrm/formLtefotaUpgradeFibocom. Within the request body, the fota_url parameter is populated with a payload that exceeds the capacity of the destination buffer. Because the function does not validate the length of this input, the overflow occurs during the copy process. By precisely controlling the overflow content, the attacker can overwrite the saved return address on the stack. Once the function execution completes, the CPU jumps to an address dictated by the attacker's payload.\nThis execution flow enables arbitrary code execution in the context of the running process, typically resulting in full system control. Because the vulnerable function is exposed via the web management interface and reachable remotely, the attack vector is network-accessible. The absence of adequate stack canaries or address space layout randomization (ASLR) in common embedded Linux firmware environments further facilitates successful exploitation. The post-exploitation impact includes the installation of persistent backdoors, data exfiltration, or complete device bricking via the destruction of firmware integrity."
}