CVE-2025-55583

Katalog CVE

CVSS 9.8 · Critical EPSS 7,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada dlink dir-868l firmware. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306: Missing Authentication for Critical Function
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

7,0% peluang dieksploitasi; lebih tinggi dari 94,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cybermaya.in/posts/Post-44/ exploit · advisory pihak ketiga
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397 product
• https://www.dlink.com/en/security-bulletin/ not applicable