A vulnerability was found in D-Link DIR-825M 1.1.8. (CVE-2026-82595)

The D-Link DIR-825M firmware version 1.1.8 contains a command injection vulnerability in the sub_456CF4 function within the /boafrm/formSysCmd component. By manipulating the sysCmd argument, an attacker with limited privileges can remotely execute arbitrary system commands. This vulnerability is tracked as CVE-2026-82595 and is associated with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS 3.1 base score is 7.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, required privileges, no user interaction, scope change, and partial impact on confidentiality, integrity, and availability. Public exploit code exists, but no confirmed active exploitation in the wild is known. No patch or vendor advisory has been provided to date.

Successful exploitation allows remote attackers with limited privileges to execute arbitrary system commands on the affected device, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. This could enable unauthorized control or disruption of the device's operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and limit privileges of users who can interact with the vulnerable component to reduce exploitation risk.