CVE-2025-13550

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Impacted is an unknown function of the file /boafrm/formVpnConfigSetup. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DIR-822K	1.00_20250513164613; 1.1.50
D-Link	DWR-M920	1.00_20250513164613; 1.1.50

References

https://github.com/QIU-DIE/CVE/issues/33Exploit, Issue Tracking
https://github.com/QIU-DIE/CVE/issues/47Exploit, Issue Tracking
https://vuldb.com/?ctiid.333317Permissions Required, VDB Entry
https://vuldb.com/?id.333317Third Party Advisory, VDB Entry
https://vuldb.com/?submit.693777Third Party Advisory, VDB Entry
https://vuldb.com/?submit.695437Third Party Advisory, VDB Entry
https://www.dlink.com/Product
https://github.com/QIU-DIE/CVE/issues/33Exploit, Issue Tracking
https://github.com/QIU-DIE/CVE/issues/47Exploit, Issue Tracking

Timeline

Published: Nov 23, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-135518.8A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The affected element is an unknown function of th CVE-2025-135528.8A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function CVE-2025-135538.8A weakness has been identified in D-Link DWR-M920 1.1.50. This affects the function sub_41C7FC of the file /boafrm/formPinManageSetup. This CVE-2025-135549.8A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.CVE-2025-135559.8A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the c CVE-2025-135569.8A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/CVE-2025-135579.8A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /reg CVE-2025-135585.4The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2025-135599.8The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'CVE-2025-13567.5A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functi CVE-2025-135609.8A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The CVE-2025-135619.8A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.p