Executive Summary
A critical stack-based buffer overflow (CVE-2026-82592) has been disclosed in the D-Link DIR-825M wireless router, firmware version 1.1.8. The flaw lives in sub_46725C, the handler behind the /boafrm/formDiskFormat endpoint that processes USB disk-formatting requests. Because the partition argument is copied into a fixed-size stack buffer without a length check, a remote, unauthenticated attacker can overflow adjacent memory and potentially achieve arbitrary code execution. A public exploit is already available, and the vulnerability carries a CVSS score as high as 9.9 (Critical).
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-82592 |
| CVSS Score | 9.4–9.9 (Critical) |
| Type | Stack-Based Buffer Overflow (CWE-121) |
| Component | sub_46725C in /boafrm/formDiskFormat (Disk Formatting Handler) |
| Attack Vector | Network (remote, unauthenticated) |
| Privileges Required | None |
| User Interaction | None |
| Exploit Status | Public exploit available |
Technical Details
The /boafrm/formDiskFormat endpoint on the DIR-825M's built-in web management interface handles requests to format a USB storage device attached to the router. The handler function, sub_46725C, reads the partition parameter from the incoming request and copies it into a fixed-size buffer on the stack without validating its length.
1. Attacker sends a crafted request to /boafrm/formDiskFormat
2. The "partition" argument contains data exceeding the allocated buffer size
3. sub_46725C copies the oversized value onto the stack without bounds checking
4. Adjacent stack memory — including saved return addresses — is overwritten
5. Attacker-controlled data can redirect execution, enabling remote code executionBecause the request requires no authentication and no user interaction, any attacker with network access to the router's management interface can trigger the overflow. If the interface is exposed to the internet — common on consumer and small-office routers that ship with remote management enabled — this becomes exploitable from anywhere.
This disclosure is part of a broader pattern of stack-overflow flaws recently reported in DIR-825M firmware 1.1.8, including a related LTE-firmware-upgrade overflow, CVE-2026-82593, disclosed the same week.
Impact
| Impact | Description |
|---|---|
| Remote Code Execution | Attacker-controlled stack overwrite can redirect execution flow |
| Full Device Compromise | Successful exploitation can grant control of the router's firmware environment |
| Network Pivot Point | A compromised router can be used to intercept or redirect all LAN traffic |
| No Authentication Required | Fully exploitable by an anonymous, unauthenticated attacker |
Remediation
D-Link has a long history of limited or no support for end-of-life consumer router models, and no vendor patch has been referenced in public advisories for this CVE as of this writing. Given the availability of a public exploit, treat this as actively exploitable and apply the following mitigations immediately:
- Disable remote/WAN-side management on the DIR-825M so the web administration interface is only reachable from the trusted LAN.
- Check D-Link's support pages for firmware updates specific to the DIR-825M and apply any available patch.
- Replace end-of-life hardware — the DIR-825M is a legacy model; if D-Link does not ship a fix, plan migration to a currently supported router.
- Segment IoT and router management traffic from sensitive internal networks using VLANs, limiting the blast radius of a compromised router.
- Monitor for anomalous requests to
/boafrm/formDiskFormatand otherboafrmendpoints in router logs, where logging is available.
Detection
| Indicator | Description |
|---|---|
Requests to /boafrm/formDiskFormat with abnormally long partition values | Signature of exploitation attempts |
| Unexpected router reboots or crash loops | Possible sign of failed or repeated exploitation attempts |
| Unrecognized outbound connections from the router itself | Possible sign of a compromised device |