CVE-2025-1800

CWE-74CWE-77 — Command InjectionCWE-3384 documents4 sources
Severity
5.3MEDIUM
EPSS
0.7%
top 28.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
D-link Dar-7000Dlink Dar-7000 Firmware
Timeline
PublishedMar 1
Latest updateJul 16

Description

A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view/vpn/sxh_vpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument ethname leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5d-link/dar-70003.2

🔴Vulnerability Details

2
CVEList
D-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injection↗2025-03-01
▶
GHSA
GHSA-hj6q-qv48-rgmf: A vulnerability has been found in D-Link DAR-7000 3↗2025-03-01
▶

📋Vendor Advisories

1
Red Hat
authen-sasl: Authen::SASL::Perl::DIGEST_MD5 insecure cnonce generation↗2025-07-16
▶
CVE-2025-1800 (MEDIUM CVSS 5.3) | A vulnerability has been found in D | cvebase.io