VulnerabilityAnalyzed
CVE-2025-6896
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1.
LOW 2.1EPSS 3.69%
Does this matter?
Lower severity and a low EPSS score (3.69%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.69% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- dlink/di-7300g\+ firmware
- Source
- cna@vuldb.com
References
- https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_1_en.pdfExploit, Third Party Advisory
- https://vuldb.com/?ctiid.314388Permissions Required, VDB Entry
- https://vuldb.com/?id.314388Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.604441Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.