PT-2025-16977 · D Link · Dir 832

Xyqer1 · Published 2025-02-19 · Updated 2025-04-22 · CVE-2025-29040

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dlink DIR 832x version 240802

Description The issue allows a remote attacker to execute arbitrary code via the target addr key value and the function 0x41737c. This enables the attacker to potentially gain control over the device.

Recommendations For dlink DIR 832x version 240802, as a temporary workaround, consider restricting access to the function 0x41737c until a patch is available. Avoid using the target addr key value in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-04946

CVE-2025-29040

Affected Products

Dir 832

References · 10

• 🔥 https://github.com/xyqer1/Dlink-dir-823x-diag_ping-target_addr-CommandInjection · Exploit
• 🔥 https://gist.github.com/xyqer1/b3bebe4967a3093951273738f0be45ce · Exploit
• https://bdu.fstec.ru/vul/2025-04946 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29040 · Security Note
• https://twitter.com/CVEnew/status/1913455520280617271 · Twitter Post
• https://twitter.com/cracbot/status/1914635365970743382 · Twitter Post
• https://t.me/cvedetector/23238 · Telegram Post
• https://twitter.com/cybercronai/status/1913268959949848899 · Twitter Post