Description

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-31T00:16:41.980Z",
  "pubdate": "2026-08-31T00:16:41.980Z",
  "executiveSummary": "A critical command injection vulnerability exists in the D-Link DIR-825M router, specifically within firmware version 1.1.8.\nThe vulnerability resides in the System Command Execution component, triggered via the /boafrm/formSysCmd URI.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges on the underlying operating system.\nThis flaw presents a severe security risk, as it facilitates full device compromise, potential lateral movement within the network, and the deployment of persistent malicious payloads.\nThe attack vector is remotely exploitable, requiring no prior authentication, and public exploit code exists, significantly increasing the probability of active exploitation.",
  "technicalDetails": "The vulnerability is located in the function sub_456CF4, which processes input parameters for the system's command interface at /boafrm/formSysCmd. The root cause is the improper sanitization of the sysCmd argument before it is passed to a system-level execution primitive, such as system() or popen().\nAn attacker can manipulate the sysCmd argument by injecting shell metacharacters (e.g., ;, |, &&, `) to terminate the intended process execution and append arbitrary commands. Because the application fails to validate the input against a strict whitelist or escape special characters, the underlying web server—running with root or high-privilege permissions—executes the attacker-supplied payload directly within the shell context.\nThe attack flow follows a predictable sequence: First, the attacker transmits an HTTP POST request targeting /boafrm/formSysCmd. The request includes the sysCmd parameter containing the malicious command payload. Upon receiving the request, the sub_456CF4 function retrieves the unvalidated input and passes it to the command-line interpreter. The shell interprets the metacharacters, executing the injected command alongside or instead of the intended legitimate function. The results of the command execution can often be observed in the HTTP response or utilized for reverse shell establishment.\nThis vulnerability is particularly dangerous due to its remote reachability. There are no authentication barriers preventing access to the /boafrm/formSysCmd endpoint. As the component is integral to the administrative web interface, it is reachable via the local network or, if misconfigured, the public-facing WAN interface. The lack of input validation and command concatenation renders the system completely susceptible to remote code execution (RCE).\nPost-exploitation impact includes the ability for an attacker to modify system configuration, disable security logging, exfiltrate sensitive network data, or turn the affected device into a node within a botnet. Given the nature of router firmware, achieving root-level code execution often provides the attacker with persistent control over the device, surviving reboots if the attacker modifies the file system or startup scripts."
}