CVE-2025-63932

Katalog CVE

CVSS 7.3 · High EPSS 7,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada dlink dir-868l firmware. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the shell command.

Rincian

Terbit di NVD

19 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

7,6% peluang dieksploitasi; lebih tinggi dari 94,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WhereisRain/DIR-868 exploit · advisory pihak ketiga
• https://github.com/WhereisRain/DIR-868/tree/main exploit · advisory pihak ketiga
• https://www.dlink.com/en/security-bulletin/ product