D-Link DIR-825M Buffer Overflow (CVE-2026-7288) Publicly Disclosed

The National Vulnerability Database has detailed a high-severity buffer overflow vulnerability, CVE-2026-7288, impacting D-Link DIR-825M firmware version 1.1.12. This flaw resides within the sub_4151FC function of the /boafrm/formVpnConfigSetup file. Attackers can trigger the vulnerability by manipulating the submit-url argument, leading to remote code execution or denial of service.

This isn’t a theoretical risk; the exploit for CVE-2026-7288 has been publicly disclosed. This dramatically lowers the bar for attackers, meaning even less sophisticated threat actors can leverage this flaw. With a CVSS score of 8.8, D-Link DIR-825M devices running the affected firmware are critical targets for opportunistic exploitation.

Defenders must recognize that D-Link routers are common perimeter devices in SMBs and home offices. A publicly available exploit for a remote buffer overflow on such a device is an immediate call to action. It enables attackers to establish a foothold, pivot deeper into networks, or simply disrupt operations. The attacker’s calculus here is straightforward: widespread device, easy exploit, high impact.