CVE-2025-1800

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1800
A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view/vpn/sxh_vpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument ethname leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/sjwszt/CVE/blob/main/CVE_1.md
https://vuldb.com/?ctiid.298030
https://vuldb.com/?id.298030
https://vuldb.com/?submit.502971
https://www.dlink.com/
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
https://github.com/sjwszt/CVE/blob/main/CVE_1.md
Configurations

No configuration.

History

05 Mar 2025, 03:15

Type Values Removed Values Added
References
  • () https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354 -

03 Mar 2025, 21:15

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en D-Link DAR-7000 3.2 y se ha clasificado como crítica. Esta vulnerabilidad afecta a la función get_ip_addr_details del archivo /view/vpn/sxh_vpn/sxh_vpnlic.php del componente HTTP POST Request Handler. La manipulación del argumento ethname provoca la inyección de comandos. El ataque puede iniciarse de forma remota. El exploit se ha hecho público y puede utilizarse. Esta vulnerabilidad solo afecta a los productos que ya no reciben soporte del fabricante.
References () https://github.com/sjwszt/CVE/blob/main/CVE_1.md - () https://github.com/sjwszt/CVE/blob/main/CVE_1.md -

01 Mar 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-01 18:15

Updated : 2025-03-05 03:15

NVD link : CVE-2025-1800

Mitre link : CVE-2025-1800

CVE.ORG link : CVE-2025-1800

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')