CVE-2025-25893

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dsl-3782_firmware:1.01:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsl-3782:-:*:*:*:*:*:*:*

History

02 May 2025, 15:46

Type Values Removed Values Added
First Time Dlink
Dlink dsl-3782 Firmware
Dlink dsl-3782
References () https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_2_en.pdf - () https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_2_en.pdf - Broken Link
CPE cpe:2.3:o:dlink:dsl-3782_firmware:1.01:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsl-3782:-:*:*:*:*:*:*:*

19 Feb 2025, 16:15

Type Values Removed Values Added
References () https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_2_en.pdf - () https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_2_en.pdf -
Summary
  • (es) Se descubrió una vulnerabilidad de inyección de comando OS en D-Link DSL-3782 V1.01 a través de los parámetros INIP, INSPORT, Informe, Export, Exeport y Protocol. Esta vulnerabilidad permite a los atacantes ejecutar los comandos de operación arbitraria sistema (OS) a través de un paquete manipulado.
CWE CWE-78
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.0

18 Feb 2025, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-02-18 22:15

Updated : 2025-05-02 15:46


NVD link : CVE-2025-25893

Mitre link : CVE-2025-25893

CVE.ORG link : CVE-2025-25893


JSON object : View

Products Affected

dlink

  • dsl-3782_firmware
  • dsl-3782
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')