PT-2025-3480 · D Link · D-Link Dir-825

Published 2024-12-29 · Updated 2025-02-01 · CVE-2024-57595

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 REVB version 2.03

Description The issue concerns an OS command injection vulnerability in the CGl interface apc client pin.cgi, which allows remote attackers to execute arbitrary commands via the wps pin parameter passed to the apc client pin.cgi binary through a POST request to the /apc client pin.cgi endpoint. This vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command when processing the wps pin parameter.

Recommendations For D-Link DIR-825 REVB version 2.03, as a temporary workaround, consider disabling the apc client pin.cgi function until a patch is available. Restrict access to the apc client pin.cgi interface to minimize the risk of exploitation. Avoid using the wps pin parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-01579

CVE-2024-57595

Affected Products

D-Link Dir-825

References · 9

• https://bdu.fstec.ru/vul/2025-01579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57595 · Security Note
• https://twitter.com/vulmoncom/status/1883920798777282865 · Twitter Post
• https://reddit.com/r/vulnintel/comments/1ibdtll/cve202457595_unauthenticated_remote_command · Reddit Post
• https://twitter.com/CVEnew/status/1883890536127381769 · Twitter Post
• https://twitter.com/cracbot/status/1885587750113489337 · Twitter Post
• https://dlink.com/en/security-bulletin · Note
• https://github.com/IdaJea/IOT_vuln_1/blob/master/DIR825/wps_pin.md · Note
• https://twitter.com/vulmoncom/status/1883920658364514345 · Twitter Post