A critical remote code execution vulnerability exists in D-Link DIR-825M routers that allows unauthenticated attackers to gain root access via manipulated firmware upgrade requests.

The vulnerability resides in the /boafrm/formLtefotaUpgradeFibocom endpoint, where the fota_url parameter is processed by the sub_41802C function. Due to insecure substring validation and the use of sprintf without bounds checking, an attacker can perform command injection or trigger a stack-based buffer overflow to execute arbitrary code as root.

Successful exploitation of this vulnerability grants an attacker full control over the affected D-Link router with root privileges. This level of access allows for total system compromise, including the ability to intercept network traffic, modify device configurations, or utilize the device as a persistent foothold within the internal network. Given the critical CVSS score of 9.9, this vulnerability presents an extreme risk to organizational security and data confidentiality.

Immediate Action: Disconnect affected D-Link DIR-825M devices from the internet immediately if firmware updates are not available or if the device cannot be patched.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boafrm/formLtefotaUpgradeFibocom endpoint and audit system logs for unexpected command executions or service crashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter and block HTTP POST requests containing suspicious shell control characters or excessively long strings directed at the vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists in the technical write-up referenced by the CVE record.

This vulnerability is critical and requires immediate attention to prevent full system compromise. Administrators must verify if their devices are running the affected firmware versions and apply the manufacturer provided patches as soon as they are available. If patching is not immediately feasible, restrict management interface access to trusted internal networks only to mitigate the risk of remote exploitation.