PT-2025-43984 · D Link · D-Link Dap-2695

Iot_Res · Published 2025-10-15 · Updated 2025-11-03 · CVE-2025-12295

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAP-2695 version 2.00RC13

Description A weakness exists in the cryptographic signature verification process within the Firmware Update Handler component, specifically in the sub 40C6B8 function. This allows for manipulation, potentially leading to improper verification. The attack can be initiated remotely and is considered highly complex with difficult exploitability. The exploit is publicly available. This issue affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

BDU:2025-13780

CVE-2025-12295

Affected Products

D-Link Dap-2695

References · 11

• 🔥 https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Inte.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-12295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12295 · Security Note
• https://bdu.fstec.ru/vul/2025-13780 · Security Note
• https://vuldb.com/?submit.675854 · Note
• https://vuldb.com/?id.329963 · Note
• https://vuldb.com/?ctiid.329963 · Note
• https://t.me/cveNotify/141358 · Telegram Post
• https://t.me/cveNotify/141373 · Telegram Post
• https://t.me/CVEtracker/35859 · Telegram Post
• https://dlink.com · Note