CVE-2025-10093

CWE-200 — Information ExposureCWE-284 — Improper Access Control3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 80.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
D-link Dir-852Dlink Dir-852 Firmware
Timeline
PublishedSep 8

Description

A vulnerability was identified in D-Link DIR-852 up to 1.00CN B09. Affected by this vulnerability is the function phpcgi_main of the file /getcfg.php of the component Device Configuration Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5d-link/dir-8521.00CN B09
▶NVDdlink/dir-852_firmware1.00cn_b09

🔴Vulnerability Details

2
GHSA
GHSA-5q22-qxph-5wqq: A vulnerability was identified in D-Link DIR-852 up to 1↗2025-09-08
▶
CVEList
D-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosure↗2025-09-08
▶