CVE-2025-13547
Published: 23 November 2025
Summary
CVE-2025-13547 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-822K Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific memory corruption flaw in the /boafrm/formDdns handler through timely firmware patching for affected D-Link routers.
Validates and sanitizes the submit-url argument to prevent manipulation that triggers memory corruption in the DDNS form.
Implements runtime memory protections like ASLR and DEP to block exploitation of the memory corruption vulnerability even if input validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption vulnerability in router web interface (/boafrm/formDdns) exploitable remotely with low privileges (PR:L, AV:N) for arbitrary code execution, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
NVD Description
A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This affects an unknown part of the file /boafrm/formDdns. This manipulation of the argument submit-url causes memory corruption. The attack may be initiated remotely. The exploit has been published…
more
and may be used.
Deeper analysisAI
CVE-2025-13547 is a memory corruption vulnerability (CWE-119) affecting D-Link DIR-822K and DWR-M920 routers on firmware versions 1.00_20250513164613 and 1.1.50. The flaw resides in an unknown part of the /boafrm/formDdns file, where manipulation of the "submit-url" argument triggers the corruption. Published on 2025-11-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential arbitrary code execution, data compromise, or denial of service on the affected device.
Advisories and further details are documented in references including GitHub issues at https://github.com/QIU-DIE/CVE/issues/30 and https://github.com/QIU-DIE/CVE/issues/42, as well as VulDB entries at https://vuldb.com/?ctiid.333314, https://vuldb.com/?id.333314, and https://vuldb.com/?submit.693758. A public exploit has been published and may be actively used.
Details
- CWE(s)