Cyber Posture

CVE-2025-13550

HighPublic PoC

Published: 23 November 2025

Published
23 November 2025
Modified
02 December 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13550 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-822K Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation directly addresses the buffer overflow vulnerability by identifying, patching, and testing firmware updates for the affected /boafrm/formVpnConfigSetup function.

prevent

Information input validation prevents buffer overflows by checking the submit-url argument for correctness, length, and appropriateness before processing.

prevent

Memory protection mechanisms such as stack canaries, ASLR, and address space layout randomization mitigate exploitation of the buffer overflow for arbitrary code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow vulnerability in the web interface (/boafrm/formVpnConfigSetup) of a public-facing router enables exploitation of a public-facing application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Impacted is an unknown function of the file /boafrm/formVpnConfigSetup. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack can be executed remotely. The exploit has been…

more

publicly disclosed and may be utilized.

Deeper analysisAI

CVE-2025-13550 is a buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers running firmware versions 1.00_20250513164613 and 1.1.50. The flaw affects an unknown function in the file /boafrm/formVpnConfigSetup, where manipulation of the submit-url argument triggers the overflow. Published on 2025-11-23, it carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-119 and CWE-120.

The vulnerability is remotely exploitable over the network by attackers with low privileges, requiring low attack complexity and no user interaction. Exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on affected devices.

References include GitHub issues at https://github.com/QIU-DIE/CVE/issues/33 and https://github.com/QIU-DIE/CVE/issues/47, along with VulDB entries at https://vuldb.com/?ctiid.333317, https://vuldb.com/?id.333317, and https://vuldb.com/?submit.693777. The exploit has been publicly disclosed and may be utilized.

Details

CWE(s)

Affected Products

dlink
dir-822k firmware
1.00_20250513164613
dlink
dwr-m920 firmware
1.1.50

CVEs Like This One

CVE-2025-13552Same product: Dlink Dir-822K
CVE-2025-13551Same product: Dlink Dir-822K
CVE-2025-13548Same product: Dlink Dir-822K
CVE-2025-15193Same product: Dlink Dwr-M920
CVE-2025-15189Same product: Dlink Dwr-M920
CVE-2025-13547Same product: Dlink Dir-822K
CVE-2025-13553Same product: Dlink Dwr-M920
CVE-2025-15190Same product: Dlink Dwr-M920
CVE-2025-13304Same product: Dlink Dwr-M920
CVE-2026-5980Same vendor: Dlink

References