PT-2025-34445 · D Link · Di-7400G+ Router

Xingyu Wu + 1 · Published 2025-08-21 · Updated 2025-10-02 · CVE-2025-57105

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: DI-7400G+ router (affected versions not specified)

Description: The DI-7400G+ router contains a command injection flaw that enables attackers to execute arbitrary commands on the device. This issue affects the sub 478D28 function within mng platform.asp and the sub 4A12DC function within wayos ac server.asp of the jhttpd program, specifically through the ac mng srv host parameter.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-10348

CVE-2025-57105

Affected Products

Di-7400G+ Router

References · 10

• 🔥 https://github.com/xyh4ck/iot_poc · Exploit
• https://bdu.fstec.ru/vul/2025-10348 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57105 · Security Note
• https://dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B · Note
• https://t.me/cveNotify/137164 · Telegram Post
• http://di-7400.com · Note
• https://twitter.com/CVEnew/status/1958964673979748666 · Twitter Post
• https://dlink.com/en/security-bulletin · Note
• https://t.me/CVEtracker/30704 · Telegram Post