PT-2025-23770 · D Link · D-Link Dcs-932L

Pjqwudi

·

Published

2025-06-04

·

Updated

2025-07-15

·

CVE-2025-5571

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions D-Link DCS-932L version 2.18.01
Description A critical issue was found in the function setSystemAdmin of the file /setSystemAdmin. The manipulation of the argument AdminID leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This issue only affects products that are no longer supported by the maintainer.
Recommendations For D-Link DCS-932L version 2.18.01, as a temporary workaround, consider disabling the setSystemAdmin function until a patch is available. Restrict access to the /setSystemAdmin file to minimize the risk of exploitation. Avoid using the argument AdminID in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2025-09909
CVE-2025-5571

Affected Products

D-Link Dcs-932L