PT-2025-35092 · D Link · D-Link Dir-868L

Shaunak Ganorkar · Published 2025-08-21 · Updated 2025-08-29 · CVE-2025-55583

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L B1 router firmware version FW2.05WWB02

Description The D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The /dws/api/UploadFile API endpoint accepts a pre api arg parameter which is passed directly to system-level shell execution functions without proper sanitization or authentication. This allows remote attackers to execute arbitrary commands as root through crafted HTTP requests.

Recommendations Update to a newer version of the firmware that addresses this issue. As a temporary workaround, restrict access to the /dws/api/UploadFile endpoint. Avoid using the pre api arg parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Missing Authentication

OS Command Injection

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-306

CWE-78

CWE-668

Related Identifiers

BDU:2025-12546

CVE-2025-55583

Affected Products

D-Link Dir-868L

References · 8

• 🔥 https://cybermaya.in/posts/Post-44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55583 · Security Note
• https://bdu.fstec.ru/vul/2025-12546 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55583 · Vendor Advisory
• https://twitter.com/CVEnew/status/1961079490718962080 · Twitter Post
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397 · Note
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/VulmonFeeds/status/1961233939219054699 · Twitter Post