PT-2025-43985 · D Link · D-Link Dap-2695

Iot_Res · Published 2025-10-15 · Updated 2025-11-03 · CVE-2025-12296

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAP-2695 version 2.00RC13

Description A security issue exists in the D-Link DAP-2695. The sub 4174B0 function within the Firmware Update Handler component is susceptible to OS command injection. This allows for remote attacks. The exploit for this issue has been made public. This vulnerability impacts products that are no longer supported by the vendor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-13781

CVE-2025-12296

Affected Products

D-Link Dap-2695

References · 10

• 🔥 https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Injection.md · Exploit
• https://bdu.fstec.ru/vul/2025-13781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12296 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12296 · Vendor Advisory
• https://t.me/cveNotify/141374 · Telegram Post
• https://vuldb.com/?ctiid.329964 · Note
• https://vuldb.com/?id.329964 · Note
• https://vuldb.com/?submit.675855 · Note
• https://t.me/CVEtracker/35860 · Telegram Post
• https://dlink.com · Note