CVE-2025-57105

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-57105
The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://di-7400.com Broken Link
https://github.com/xyh4ck/iot_poc Exploit Third Party Advisory
https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B Product
https://www.dlink.com/en/security-bulletin/ Not Applicable
https://github.com/xyh4ck/iot_poc Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:di-7400g\+_firmware:19.12.25a1:*:*:*:*:*:*:*
cpe:2.3:h:dlink:di-7400g\+:a1:*:*:*:*:*:*:*
History

02 Oct 2025, 13:07

Type Values Removed Values Added
CPE cpe:2.3:h:dlink:di-7400g\+:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:di-7400g\+:a1:*:*:*:*:*:*:*

01 Oct 2025, 20:17

Type Values Removed Values Added
First Time Dlink
Dlink di-7400g\+
Dlink di-7400g\+ Firmware
CPE cpe:2.3:o:dlink:di-7400g\+_firmware:19.12.25a1:*:*:*:*:*:*:*
cpe:2.3:h:dlink:di-7400g\+:-:*:*:*:*:*:*:*
References () http://di-7400.com - () http://di-7400.com - Broken Link
References () https://github.com/xyh4ck/iot_poc - () https://github.com/xyh4ck/iot_poc - Exploit, Third Party Advisory
References () https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B - () https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B - Product
References () https://www.dlink.com/en/security-bulletin/ - () https://www.dlink.com/en/security-bulletin/ - Not Applicable

26 Aug 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-77
Summary
  • (es) El enrutador DI-7400G+ presenta una vulnerabilidad de inyección de comandos que permite a los atacantes ejecutar comandos arbitrarios en el dispositivo. La función sub_478D28 se encuentra en mng_platform.asp y la función sub_4A12DC en wayos_ac_server.asp del programa jhttpd, con el parámetro ac_mng_srv_host.
References () https://github.com/xyh4ck/iot_poc - () https://github.com/xyh4ck/iot_poc -

22 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 17:15

Updated : 2025-10-02 13:07

NVD link : CVE-2025-57105

Mitre link : CVE-2025-57105

CVE.ORG link : CVE-2025-57105

JSON object : View

Products Affected

dlink

  • di-7400g\+
  • di-7400g\+_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')