CVE-2025-15193

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. This affects the function sub_423848 of the file /boafrm/formParentControl. Performing manipulation of the argument submit-url results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DWR-M920	1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.1.6; 1.1.7; 1.1.8; 1.1.9; 1.1.10; 1.1.11; 1.1.12; 1.1.13; 1.1.14; 1.1.15; 1.1.16; 1.1.17; 1.1.18; 1.1.19

References

https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formParentControl.mdExploit, Third Party Advisory
https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formParentControl.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.338578Permissions Required, VDB Entry
https://vuldb.com/?id.338578Third Party Advisory, VDB Entry
https://vuldb.com/?submit.723556Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Dec 29, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-151949.8A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.c CVE-2025-151959.8A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file CVE-2025-151969.8A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipula CVE-2025-151977.2A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects u CVE-2025-151989.8A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /CVE-2025-151998.8A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file CVE-2025-15208.0PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t CVE-2025-152004.8A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getComman CVE-2025-152015.4A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/s CVE-2025-152024.8A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/CVE-2025-152034.8A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/con CVE-2025-152044.8A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/ca