Loading story…
Two high-severity vulnerabilities, CVE-2026-7288 and CVE-2026-7289, were disclosed in D-Link DIR-825M firmware 1.1.12, exposing the router to remotely exploitable buffer overflows. The flaws affect the /boafrm/formVpnConfigSetup and /boafrm/formWanConfigSetup components, where improper handling of the submit-url argument in functions sub_4151FC and sub_414BA8 can trigger memory corruption.
Both CVEs were classified under CWE-119 and CWE-120 and were assigned high-impact ratings across confidentiality, integrity, and availability. Public exploit information is already available, and one entry notes exploitation is possible with low attack complexity and low privileges, raising the risk of real-world abuse against exposed or improperly managed devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-7289, was recorded for D-Link DIR-825M firmware version 1.1.12 affecting the /boafrm/formWanConfigSetup component. The flaw in function sub_414BA8 allows a remotely exploitable buffer overflow via the submit-url argument, with public exploit information available.
A new CVE entry, CVE-2026-7288, was recorded for D-Link DIR-825M firmware version 1.1.12 affecting the /boafrm/formVpnConfigSetup component. The flaw in function sub_4151FC allows a remotely exploitable buffer overflow via the submit-url argument, and public exploit information was disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-5983** and **CVE-2026-5984**, were disclosed in the unsupported **D-Link DIR-605L** router running firmware `2.13B01`. Both flaws are remote **buffer overflows** tied to POST request handlers exposed under `/goform/`, with the `curTime` argument identified as the attack vector. **CVE-2026-5983** affects the `formSetDDNS` function in `/goform/formSetDDNS`, while **CVE-2026-5984** affects the `formSetLog` function in `/goform/formSetLog`. The vulnerabilities are classified under **CWE-119** and **CWE-120** and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a **public exploit** is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Jun 29, 2026
Two router vulnerabilities have been disclosed that expose **D-Link DIR-513** and **Tenda A18 Pro** devices to remotely triggered stack-based buffer overflows. **CVE-2026-4486** affects D-Link DIR-513 version `1.10` in the web service function `formEasySetPassword` at the `/goform/formEasySetPassword` endpoint, where a crafted `curTime` argument can trigger memory corruption. The issue is classified under `CWE-119` and `CWE-121`, and the affected D-Link product is no longer supported by the vendor. A separate flaw, **CVE-2026-4491**, impacts **Tenda A18 Pro** firmware `02.03.02.28` in the `fromSetIpMacBind` function exposed through `/goform/SetIpMacBind`. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as **publicly exploitable**, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Jun 29, 2026
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026