The vulnerability is a stack-based buffer overflow triggered by controlling the submit-url parameter in the formVpnConfigSetup function. Exercising this flaw allows an unauthenticated remote attacker to inject data that overflows the internal buffer, resulting in arbitrary code execution. The weakness is a classic example of CWE‑119 and CWE‑120 vulnerabilities.

Affected product is D‑Link DIR‑825M routers running firmware 1.1.12, as sold by D‑Link. The issue resides in the /boafrm/formVpnConfigSetup code path, accessible via the router’s web administration interface.

The CVSS score of 8.7 indicates high severity. The documented EPSS score is not available, so the current likelihood of exploitation cannot be precisely quantified, but the flaw is publicly disclosed and may be leveraged. The vulnerability is not listed in the CISA KEV catalog. Attackers likely must gain network access to the router’s management port and send a specially crafted request to the submit-url endpoint; the failure of input validation makes exploitation straightforward for an automated attacker with the requisite network reach.