CVE-2026-7288
Published: 28 April 2026
Summary
CVE-2026-7288 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-825M Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7288 is a buffer overflow vulnerability in D-Link DIR-825M routers running firmware version 1.1.12. The flaw affects the function sub_4151FC in the file /boafrm/formVpnConfigSetup, where manipulation of the submit-url argument triggers the overflow. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, such as authenticated users, requiring only network access and low complexity with no user interaction. Successful attacks can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or denial of service on the affected device.
Advisories and additional details are available via VulDB entries (https://vuldb.com/vuln/359946, https://vuldb.com/submit/803024, https://vuldb.com/vuln/359946/cti) and a GitHub issue disclosing the exploit (https://github.com/Kiciot/cve/issues/2). The D-Link website (https://www.dlink.com/) may provide further vendor guidance.
The vulnerability was published on 2026-04-28, and a public exploit has been disclosed, increasing the risk of active exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26067
Vulnerability details
A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub_4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been…
more
disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (formVpnConfigSetup) allows remote authenticated attackers to achieve arbitrary code execution, directly enabling exploitation of public-facing applications (T1190) and exploitation for privilege escalation from low privileges to full control (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow vulnerability in the DIR-825M firmware by requiring timely application of vendor patches or updates.
Prevents exploitation by enforcing validation of the submit-url argument to block buffer overflow triggers in formVpnConfigSetup.
Mitigates buffer overflow impacts through memory protections like ASLR and DEP, hindering arbitrary code execution on the router.