PT-2025-35426 · D Link · Jhttpd+1

Physicszq · Published 2025-08-30 · Updated 2025-09-04 · CVE-2025-9745

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DI-500WF version 14.04.10A1T

Description A security issue has been identified in D-Link DI-500WF. The vulnerability resides in an unknown function within the /version upgrade.asp file of the jhttpd component. Manipulation of the path argument can lead to os command injection, allowing for remote exploitation. The exploit has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-11435

CVE-2025-9745

Affected Products

Di-500Wf

Jhttpd

References · 15

• 🔥 https://github.com/physicszq/Routers/blob/main/tmp/01/poc.py · Exploit
• 🔥 https://github.com/physicszq/Routers/tree/main/tmp/01 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9745 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9745 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11435 · Security Note
• https://twitter.com/SecAideInfo/status/1963183638612176963 · Twitter Post
• https://t.me/cveNotify/134008 · Telegram Post
• https://twitter.com/SecAideInfo/status/1963546132275134852 · Twitter Post
• https://twitter.com/CVEnew/status/1962256643535544774 · Twitter Post
• https://vuldb.com/?submit.640394 · Note
• https://t.me/CVEtracker/31382 · Telegram Post
• https://vuldb.com/?ctiid.322044 · Note
• https://vuldb.com/?id.322044 · Note
• https://twitter.com/SecAideInfo/status/1962821639055315245 · Twitter Post
• https://dlink.com · Note