CVE-2025-25895

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25895
An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_3_en.pdf Broken Link
https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_3_en.pdf Broken Link
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dsl-3782_firmware:1.01:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsl-3782:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2025-02-18 22:15

Updated : 2025-05-02 15:46

NVD link : CVE-2025-25895

Mitre link : CVE-2025-25895

CVE.ORG link : CVE-2025-25895

JSON object : View

Products Affected

dlink

  • dsl-3782
  • dsl-3782_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')