CVE-2025-13548
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50 contain a buffer overflow in unknown code of /boafrm/formFirewallAdv via manipulation of the submit-url argument. The attack can be launched remotely and a public exploit has been disclosed.
Risk Assessment
A remote attacker could leverage the public exploit to cause a buffer overflow, potentially leading to code execution or device instability.
Recommendation
Update the device firmware to the latest version or apply compensating controls if no patch is available.
Other vulnerabilities in D-Link DIR-822K/DWR-M920
See all- CVE-2025-13552High
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function of the file /boafrm/formWlEncrypt, where manipulation of the submit-url argument results in buffer overflow; the attack may be performed remotely.
- CVE-2025-13551High
A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The affected element is an unknown function of the file /boafrm/formWanConfigSetup, where manipulation of the submit-url argument leads to buffer overflow; the attack is possible to carry out remotely.
- CVE-2025-13550High
A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. An unknown function of the file /boafrm/formVpnConfigSetup is impacted, where manipulation of the submit-url argument can lead to buffer overflow; the attack can be executed remotely.
- CVE-2025-13547High
A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50 affecting an unknown part of the file /boafrm/formDdns. Manipulation of the submit-url argument causes memory corruption, and the attack may be initiated remotely.
Original NVD description (English source)
A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFirewallAdv. Such manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS