Paper/Archive/CVE-2025-55583

CVE-2025-55583

mitre — D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.c…

EPSS 7%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 94.1.941 × 2018.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refdlink.com/en/security-bulletin refsupportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397 exploitcybermaya.in/posts/Post-44