VulnerabilityAnalyzed
CVE-2025-4340
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03.
MEDIUM 5.3EPSS 4.89%
Does this matter?
Lower severity and a low EPSS score (4.89%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.89% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- dlink/dir-806 firmware · dlink/dir-890l firmware
- Source
- cna@vuldb.com
References
- https://github.com/CH13hh/tmp_store_cc/blob/main/tt/1.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.307458Permissions Required, VDB Entry
- https://vuldb.com/?id.307458Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.556092Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
- https://github.com/CH13hh/tmp_store_cc/blob/main/tt/1.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.