CVE-2026-82595: D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection

Published Aug 30, 2026

Updated

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Affected Software

1 affected component

D-Link DIR-825M=1.1.8

Event History

Aug 30, 2026

CVE Published

via MITRE·11:45 PM

Data Sourced

via MITRE·11:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The published severity vector indicates that low privileges are required. Exploitation does not require user interaction and can be initiated remotely.

Which deployments are known to be affected?

The affected product and version identified in the available data are D-Link DIR-825M 1.1.8. The vulnerable functionality is the System Command Execution endpoint at /boafrm/formSysCmd.

Is public exploit code available?

Yes. The vulnerability information states that an exploit has been made public and could be used.