PT-2025-17078 · D Link · Dir 832

Xyqer1 · Published 2025-04-17 · Updated 2025-04-19 · CVE-2025-29042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dlink DIR 832x version 240802

Description The issue allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c. This enables the attacker to potentially gain control over the device.

Recommendations For dlink DIR 832x version 240802, as a temporary workaround, consider restricting access to the function 0x42232c until a patch is available. Avoid using the macaddr key value in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-29042

Affected Products

Dir 832

References · 7

• 🔥 https://github.com/xyqer1/Dlink-dir-823x-set_prohibiting-macaddr-CommandInjection · Exploit
• 🔥 https://gist.github.com/xyqer1/841e78a3c4029808dac8c439595a1358 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29042 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29042 · Vendor Advisory
• https://twitter.com/cybercronai/status/1913268959949848899 · Twitter Post
• https://twitter.com/CVEnew/status/1913455521920598464 · Twitter Post