CVE-2025-13553
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A weakness has been identified in D-Link DWR-M920 1.1.50 affecting the function sub_41C7FC in /boafrm/formPinManageSetup. Manipulation of the submit-url argument causes a buffer overflow, and the attack can be initiated remotely. The exploit has been made publicly available and could be exploited.
Risk Assessment
A remote attacker could exploit the buffer overflow to crash the device or execute unauthorized code. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update D-Link DWR-M920 firmware to the latest version or restrict access to the management interface. If no fix is available, consider disabling the vulnerable functionality or replacing the device.
Other vulnerabilities in D-Link DWR-M920
See all- CVE-2026-90699Critical
A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2025-15192Medium
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
- CVE-2025-15191Medium
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
- CVE-2026-10878Medium
A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.
- CVE-2025-15193High
D-Link DWR-M920 up to version 1.1.50 has a buffer overflow vulnerability in the function sub_423848 in /boafrm/formParentControl. Manipulation of the submit-url argument results in buffer overflow. The attack can be carried out remotely, and the exploit is now public.
- CVE-2025-15190High
A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. The function sub_42261C in file /boafrm/formFilter is affected. Manipulation of the ip6addr argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2025-15189High
A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. The function sub_464794 in file /boafrm/formDefRoute is affected. Manipulation of the submit-url argument leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in D-Link DWR-M920 1.1.50. This affects the function sub_41C7FC of the file /boafrm/formPinManageSetup. This manipulation of the argument submit-url causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS