CVE-2025-9769

Опубликовано: 01 сент. 2025

Источник: nvd

CVSS3: 4.1

CVSS3: 6.2

CVSS2: 4.3

EPSS Низкий

Описание

A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input echo 12345 > poc.txt results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.

Ссылки

https://github.com/xyh4ck/iot_poc
Exploit
Third Party Advisory
https://github.com/xyh4ck/iot_poc#vulnerability-verification-process
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.322069
Permissions Required
VDB Entry
https://vuldb.com/?id.322069
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.640779
Third Party Advisory
VDB Entry
https://www.dlink.com/
Product
https://github.com/xyh4ck/iot_poc
Exploit
Third Party Advisory
https://github.com/xyh4ck/iot_poc#vulnerability-verification-process
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:dlink:di-7400g\+_firmware:19.12.25a1:*:*:*:*:*:*:*

cpe:2.3:h:dlink:di-7400g\+:v2.a1:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00059

Низкий

4.1 Medium

CVSS3

6.2 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-74

CWE-77

Связанные уязвимости

BDU:2025-11438

CVSS3: 4.1

fstec

около 2 месяцев назад

Уязвимость функции sub_478D28 микропрограммного обеспечения маршрутизатора D-Link DI-7400G+, позволяющая нарушителю получить несанкционированный доступ к интерфейсу администратора

EPSS

Процентиль: 19%

0.00059

Низкий

4.1 Medium

CVSS3

6.2 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-74

CWE-77