CVE-2025-13547: D-Link DIR-822K/DWR-M920 formDdns memory corruption

Published Nov 23, 2025

Updated

A flaw has been found in D-Link DIR-822K and DWR-M920 1.0020250513164613/1.1.50. This affects an unknown part of the file /boafrm/formDdns. This manipulation of the argument submit-url causes memory corruption. The attack may be initiated remotely. The exploit has been published and may be used.

Affected Software

6 affected components

D-Link DIR-822K

D-Link DWR-M920

All of the following

Dlink Dir-822k Firmware=1.00_20250513164613

Dlink Dir-822k

All of the following

Dlink Dwr-m920 Firmware=1.1.50

Dlink Dwr-m920=b2

Event History

Nov 23, 2025

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-13547?

CVE-2025-13547 has a high severity level due to the potential for remote exploitation and memory corruption.

How do I fix CVE-2025-13547?

To fix CVE-2025-13547, you should update the firmware of your D-Link DIR-822K or DWR-M920 to the latest version provided by D-Link.

What systems are affected by CVE-2025-13547?

CVE-2025-13547 affects the D-Link DIR-822K and D-Link DWR-M920 routers.

What type of vulnerability is CVE-2025-13547?

CVE-2025-13547 is a memory corruption vulnerability that can be triggered by manipulating the submit-url parameter.

Can CVE-2025-13547 be exploited remotely?

Yes, CVE-2025-13547 can be exploited remotely, allowing attackers to initiate the attack without physical access to the devices.