CVE-2025-13548
Published: 23 November 2025
Summary
CVE-2025-13548 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-822K Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates the submit-url argument in the /boafrm/formFirewallAdv endpoint to prevent buffer overflow exploitation.
Implements memory protections like ASLR and DEP to mitigate arbitrary code execution from buffer overflows.
Requires timely flaw remediation through firmware patching to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing router web interface (/boafrm/formFirewallAdv) via remote manipulation of submit-url enables exploitation of public-facing applications (T1190), remote services (T1210), and application exploitation leading to DoS via crashes (T1499.004).
NVD Description
A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFirewallAdv. Such manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been…
more
disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-13548 is a buffer overflow vulnerability (CWE-119, CWE-120) in D-Link DIR-822K and DWR-M920 routers running firmware versions 1.00_20250513164613 and 1.1.50. The flaw affects unknown code in the /boafrm/formFirewallAdv file, where manipulation of the submit-url argument triggers the overflow. Published on 2025-11-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, such as authenticated users over the network, without requiring user interaction. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.
Advisories and references, including GitHub issues at QIU-DIE/CVE/31 and /43, and VulDB entries (ctiid.333315, id.333315, submit.693767), document the issue. The exploit has been publicly disclosed and may be used by attackers. No specific patch or mitigation details are provided in the available information.
Details
- CWE(s)