PT-2025-35092 · D Link · D-Link Dir-868L

Shaunak Ganorkar · Published 2025-08-28 · Updated 2025-08-29 · CVE-2025-55583

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

D-Link DIR-868L B1 router firmware version FW2.05WWB02

Description:

The D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the `fileaccess.cgi` component. The `/dws/api/UploadFile` API endpoint accepts a `pre api arg` parameter which is passed directly to system-level shell execution functions without proper sanitization or authentication. This allows remote attackers to execute arbitrary commands as root through crafted HTTP requests.

Recommendations:

Update to a newer version of the firmware that addresses this issue.

As a temporary workaround, restrict access to the `/dws/api/UploadFile` endpoint.

Avoid using the `pre api arg` parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Missing Authentication

Exposure of Resource to Wrong Sphere

OS Command Injection

Weakness Enumeration

CWE-306

CWE-668

CWE-78

Related Identifiers

CVE-2025-55583

Affected Products

D-Link Dir-868L

References · 6

• 🔥 https://cybermaya.in/posts/Post-44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55583 · Security Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397 · Note
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/CVEnew/status/1961079490718962080 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1961233939219054699 · Twitter Post