PT-2025-34954 · D Link · D-Link Dir-610+6

Published 2025-08-21 · Updated 2025-08-28 · CVE-2018-25115

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-110 version 1.03 D-Link DIR-412 version 1.03 D-Link DIR-600 version 1.03 D-Link DIR-610 version 1.03 D-Link DIR-615 version 1.03 D-Link DIR-645 version 1.03 D-Link DIR-815 version 1.03

Description Multiple D-Link DIR-series routers are affected by a flaw that allows remote attackers to execute arbitrary system commands without authentication. The issue is due to improper input handling in the EVENT=CHECKFW parameter of the /service.cgi API endpoint, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, potentially leading to full device compromise. The Shadowserver Foundation first observed exploitation evidence on 2025-08-21 UTC.

Recommendations D-Link DIR-110 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-412 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-600 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-610 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-615 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-645 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-815 version 1.03: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-10679

CVE-2018-25115

Affected Products

D-Link Dir-110

D-Link Dir-412

D-Link Dir-600

D-Link Dir-610

D-Link Dir-615

D-Link Dir-645

D-Link Dir-815

References · 11

• 🔥 https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce · Exploit
• 🔥 https://exploit-db.com/exploits/43496 · Exploit
• https://osv.dev/vulnerability/CVE-2018-25115 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-25115 · Security Note
• https://t.me/cveNotify/133854 · Telegram Post
• https://t.me/CVEtracker/31072 · Telegram Post
• https://twitter.com/dpharristech/status/1961177155796074908 · Twitter Post
• https://legacy.us.dlink.com · Note
• https://support.dlink.com/EndOfLifePolicy.aspx · Note
• https://vulncheck.com/advisories/dlink-dir-rce-service-cgi · Note