CVE-2025-13552
Published: 23 November 2025
Summary
CVE-2025-13552 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-822K Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates manipulated inputs like the submit-url argument to prevent buffer overflow exploitation in the /boafrm/formWlEncrypt function.
Implements memory protections such as stack canaries or DEP to mitigate arbitrary code execution from buffer overflow vulnerabilities.
Requires timely flaw remediation through firmware updates for affected D-Link DIR-822K and DWR-M920 versions to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow vulnerability in the web management interface (/boafrm/formWlEncrypt) of D-Link routers enables remote arbitrary code execution over the network, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote.…
more
The exploit has been released to the public and may be exploited.
Deeper analysisAI
CVE-2025-13552 is a buffer overflow vulnerability (CWE-119, CWE-120) discovered in D-Link DIR-822K and DWR-M920 routers running firmware versions 1.00_20250513164613 and 1.1.50. The flaw affects an unknown function in the /boafrm/formWlEncrypt file and is triggered by manipulating the submit-url argument.
The vulnerability enables remote exploitation over the network with low attack complexity and requires low privileges (PR:L) but no user interaction (CVSS:3.1 score of 8.8; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with such access can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.
Advisories and details are available in references such as GitHub issues at https://github.com/QIU-DIE/CVE/issues/36 and https://github.com/QIU-DIE/CVE/issues/44, along with VulDB entries at https://vuldb.com/?ctiid.333319, https://vuldb.com/?id.333319, and https://vuldb.com/?submit.693803; no specific patches or mitigations are detailed in the disclosure.
An exploit for this vulnerability has been publicly released, indicating potential for active exploitation.
Details
- CWE(s)