PT-2025-27483 · D Link · D-Link Dcs-7517

Cookedmelon · Published 2025-06-30 · Updated 2025-07-01 · CVE-2025-6932

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: D-Link DCS-7517 versions up to 2.02.0

Description: A vulnerability was found in the Qlync Password Generation Handler component, affecting the function g F n GenPassForQlync of the file /bin/httpd. The manipulation leads to the use of hard-coded passwords. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Recommendations: For D-Link DCS-7517 versions up to 2.02.0, as a temporary workaround, consider disabling the g F n GenPassForQlync function until a patch is available. Restrict access to the /bin/httpd file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

CWE-259

Related Identifiers

BDU:2025-09330

CVE-2025-6932

Affected Products

D-Link Dcs-7517

References · 12

• 🔥 http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6932 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6932 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09330 · Security Note
• https://vuldb.com/?ctiid.314445 · Note
• https://vuldb.com/?submit.605595 · Note
• https://twitter.com/CVEnew/status/1939825119108473117 · Twitter Post
• https://dlink.com · Note
• https://twitter.com/VulmonFeeds/status/1939830811882094631 · Twitter Post
• https://t.me/cvetracker/27471 · Telegram Post
• https://vuldb.com/?id.314445 · Note
• https://t.me/cvenotify/127182 · Telegram Post