CVE-2026-82592

D-Link DIR-825M firmware 1.1.8 contains a stack-based buffer overflow in the Disk Formatting Handler Endpoint at /boafrm/formDiskFormat (function sub_46725C, CWE-119/CWE-121). An attacker can trigger the flaw remotely by sending a request to that endpoint with an overly long 'partition' argument, overwriting stack memory. Successful exploitation could crash the affected service and potentially allow arbitrary code execution on the router; the CVSS 4.0 score of 8.6 (high) reflects high impact on confidentiality, integrity and availability, with the attack requiring network access and low privileges and no user interaction. Only owners of D-Link DIR-825M routers, particularly those running firmware 1.1.8 with the web management interface reachable, are affected. The advisory states the exploit is now public and may be used, though no formal PoC is catalogued, the flaw is not yet in CISA's KEV, and EPSS currently estimates a 0.8% probability of exploitation in the next 30 days.

What to do: DIR-825M owners should verify their firmware version and update to the latest D-Link release when a patched build is published, as the advisory does not specify a fixed version. Until then, restrict the router's web management interface to trusted LAN clients and disable WAN-side remote management to limit exposure of the formDiskFormat endpoint. Defenders should also watch for vendor advisories and update this dashboard entry once a fixed firmware version or KEV listing is confirmed.