PT-2025-36463 · D Link · D-Link Dir-852

Ic0Rner · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-10093

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

D-Link DIR-852 versions up to 1.00CN B09

Description:

A vulnerability exists in D-Link DIR-852 that allows for information disclosure. The vulnerability is located in the `phpcgi main` function of the `/getcfg.php` file within the Device Configuration Handler component. This manipulation can be performed remotely. The exploit is publicly available. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2025-10093

Affected Products

D-Link Dir-852

References · 10

• 🔥 https://github.com/i-Corner/cve/issues/21 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10093 · Security Note
• https://vuldb.com/?ctiid.323049 · Note
• https://vuldb.com/?submit.644935 · Note
• https://t.me/cveNotify/134609 · Telegram Post
• https://vuldb.com/?id.323049 · Note
• https://twitter.com/CVEnew/status/1965030009866739714 · Twitter Post
• https://dlink.com · Note
• https://t.me/cveNotify/134613 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965039058276499787 · Twitter Post