VulnerabilityAnalyzed
CVE-2025-10689
A vulnerability was identified in D-Link DIR-645 105B01.
LOW 2.1EPSS 4.56%
Does this matter?
Lower severity and a low EPSS score (4.56%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.56% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- dlink/dir-645 firmware
- Source
- cna@vuldb.com
References
- https://github.com/scanleale/IOT_sec/blob/main/DIR-645-soapcgi.pdfExploit, Third Party Advisory
- https://vuldb.com/?ctiid.324813Permissions Required, VDB Entry
- https://vuldb.com/?id.324813Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.653689Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.