cbcvebase.
CVE-2025-14225
published 2025-12-08

CVE-2025-14225: A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing…

PriorityP271high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
7.68%
93.9th percentile
A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdcs-930l——
dlinkdcs-930l_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/setSystemAdmin↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link setSystemAdmin AdminID Parameter Command Injection Attempt (CVE-2025-14225)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:15; content:"/setSystemAdmin"; fast_pattern; http.request_body; content:"AdminID|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-1/D-Link%20Vulnerability.md; reference:cve,2025-14225; classtype:web-application-attack; sid:2066183; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_12_08, cve CVE_2025_14225, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_12_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
POST body contains: AdminID= followed by shell metacharacters (;, \n, `, |, $) — encoded or literal
  • →Look for HTTP POST requests to the exact URI /setSystemAdmin (URI length is exactly 15 bytes) targeting D-Link DCS-930L devices
  • →Inspect POST body for the AdminID parameter followed by shell injection metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24) — both literal and URL-encoded forms should be detected
  • →Traffic is expected in plaintext (not TLS); deploy detection at perimeter and internal network boundaries
  • →The exploit has been publicly disclosed; treat any matching traffic as high-confidence active exploitation (MITRE T1190 - Exploit Public-Facing Application)
  • ·The vulnerability affects D-Link DCS-930L firmware version 1.15.04, which is end-of-life and no longer supported by the vendor — no patch will be issued ↗
  • ·The vulnerable component is the alphapd process handling /setSystemAdmin; the injection point is specifically the AdminID argument ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.