CVE-2025-25893

CWE-78 — OS Command InjectionCWE-285CWE-287 — Improper Authentication4 documents4 sources
Severity
8.0HIGH
EPSS
0.0%
top 89.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Dlink Dsl-3782 Firmware
Timeline
PublishedFeb 18
Latest updateFeb 5

Description

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting↗2026-02-05
▶
GHSA
GHSA-5pp8-6xcp-c279: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1↗2025-02-19
▶
CVEList
CVE-2025-25893: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1↗2025-02-18
▶