CVE-2018-25115

published 2025-08-27

CVE-2018-25115: Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability…

Priority P1 91 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW VulnCheck KEV

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-110	—	—
d-link	dir-412	—	—
d-link	dir-600	—	—
d-link	dir-615	—	—
d-link	dir-645	—	—
d-link	dir-815	—	—
dlink	dir-815_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /service.cgi

command POST /service.cgi with body EVENT=<injected command>↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link service.cgi EVENT Parameter Command Injection Attempt (CVE-2018-25115)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:12; content:"/service.cgi"; fast_pattern; http.request_body; content:"EVENT|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce; reference:cve,2018-25115; classtype:attempted-admin; sid:2064199; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_28, cve CVE_2018_25115, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Detect HTTP POST requests to /service.cgi with an EVENT= parameter body containing shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24) — indicative of command injection attempts.
• → The URI /service.cgi has an exact byte size of 12; use bsize:12 matching to reduce false positives when hunting for this endpoint.
• → Exploitation requires no authentication; any unauthenticated POST to /service.cgi on D-Link DIR-series devices (DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, DIR-815 firmware 1.03) should be treated as suspicious. ↗
• → Successful exploitation results in root-level command execution on the device; look for unexpected outbound connections or new processes spawned from the web service process on affected routers. ↗
• → Active exploitation in the wild was first observed by the Shadowserver Foundation on 2025-08-21 UTC; prioritize detection on perimeter and internal network segments for these legacy D-Link devices. ↗

• · Affected devices are end-of-life and no longer supported; no vendor patch is available. The only remediation is device replacement or network-level blocking. ↗
• · The Snort/Suricata rule (SID 2064199) is scoped to plaintext HTTP traffic only (tls_state plaintext); it will not fire on HTTPS-wrapped traffic if the device is somehow proxied.
• · Affected firmware version is listed as 1.03, but the advisory notes that affected version ranges may vary across the multiple DIR-series models. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vulncheck 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78