CVE-2026-82593

CVE-2026-82593 is a stack-based buffer overflow (CWE-119/CWE-121) in the LTE Module Firmware Upgrade component of the boa web server on D-Link DIR-825M routers, specifically in function sub_41802C of the handler /boafrm/formLtefotaUpgradeFibocom. A remote attacker triggers it by submitting an overlong or crafted fota_url parameter to that endpoint, overflowing a fixed on-stack buffer; the CVSS 4.0 vector (AV:N/PR:L/UI:N) indicates network-based exploitation with low-privileged access and no user interaction. Successful overflow could allow remote code execution on the router, or at minimum a crash of the HTTP service, consistent with the high confidentiality, integrity and availability impacts in the 8.6 (High) CVSS 4.0 score. Only DIR-825M devices on the affected firmware are impacted; practically, units whose management web interface is reachable over the network (exposed to the WAN, port-forwarded, or accessed by an attacker already on the LAN). The exploit has been published and may be used (CVSS 4.0 exploit maturity E:P), although no standalone public proof-of-concept is catalogued; EPSS currently estimates a 0.5% probability of exploitation within 30 days and the flaw is not yet in CISA's KEV catalog.

What to do: DIR-825M owners should verify their firmware version and, if on 1.1.8, apply D-Link's patched firmware as soon as it is released (no fixed version number is stated in the available data), and confirm with D-Link whether other firmware versions are affected. In the meantime, avoid exposing the router's web management interface to the WAN and restrict admin access to trusted LAN hosts. Given the published exploit, monitor for abnormal or oversized fota_url requests to /boafrm/formLtefotaUpgradeFibocom and consider blocking or rate-limiting them at the network edge.