PT-2025-53723 · D Link · D-Link Dwr-M920

Panda_0X1 · Published 2025-12-29 · Updated 2025-12-30 · CVE-2025-15192

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DWR-M920 versions up to 1.1.50

Description A security issue exists in D-Link DWR-M920. Manipulation of the fota url argument within the sub 415328 function of the /boafrm/formLtefotaUpgradeQuectel file can lead to command injection. This attack can be carried out remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 1.1.50 should be updated. As a temporary workaround, consider restricting access to the /boafrm/formLtefotaUpgradeQuectel file to minimize the risk of exploitation. Avoid using the fota url parameter in the affected function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-15192

Affected Products

D-Link Dwr-M920

References · 9

• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md · Exploit
• 🔥 https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15192 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15192 · Vendor Advisory
• https://vuldb.com/?ctiid.338577 · Note
• https://vuldb.com/?id.338577 · Note
• https://vuldb.com/?submit.723555 · Note
• https://t.me/cveNotify/147224 · Telegram Post
• https://dlink.com · Note