PT-2025-38290 · D Link · Dir-852

Ic0Rner · Published 2025-09-09 · Updated 2025-09-18 · CVE-2025-10628

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-852 version 1.00CN B09

Description A vulnerability exists in the Web Management Interface component of D-Link DIR-852 version 1.00CN B09. Manipulation of unknown code within the /htdocs/cgibin/hedwig.cgi file can lead to command injection. This issue is remotely exploitable. The exploit has been made public. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2025-12535

CVE-2025-10628

Affected Products

Dir-852

References · 11

• 🔥 https://github.com/i-Corner/cve/issues/31 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10628 · Security Note
• https://bdu.fstec.ru/vul/2025-12535 · Security Note
• https://vuldb.com/?id.324658 · Note
• https://vuldb.com/?submit.650656 · Note
• https://dlink.com · Note
• https://vuldb.com/?ctiid.324658 · Note
• https://t.me/CVEtracker/32814 · Telegram Post
• https://twitter.com/CVEnew/status/1968561152847233388 · Twitter Post
• https://t.me/cveNotify/135746 · Telegram Post