CVE-2025-55583: D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The…

PriorityP276critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

5.83%

92.3th percentile

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-868l_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/dws/api/UploadFile↗

path/dws/api/fileaccess.cgi↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link fileaccess.cgi pre_api_arg Parameter Command Injection Attempt (CVE-2025-55583)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"/dws/api/fileaccess.cgi"; fast_pattern; http.request_body; content:"pre_api_arg|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,cybermaya.in/posts/Post-44/; reference:cve,2025-55583; classtype:attempted-admin; sid:2064112; rev:1;)

bytes

pre_api_arg|3d|

→Look for HTTP POST requests to /dws/api/fileaccess.cgi (exact URI length 23 bytes) containing 'pre_api_arg=' in the request body with shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24) following the parameter value.
→The vulnerability is unauthenticated — no session token or credentials are required in the HTTP request. Alert on POST requests to the affected endpoint from any external source without authentication headers. ↗
→Commands injected via pre_api_arg execute as root. Monitor for unexpected child processes spawned by fileaccess.cgi or the web server process on D-Link DIR-868L B1 devices. ↗
→Deployment context: rule is recommended for both Perimeter and Internal network monitoring, targeting plaintext (non-TLS) HTTP traffic.

·Affected product is specifically D-Link DIR-868L B1 running firmware version FW2.05WWB02 only. Ensure detections are scoped to this device/firmware combination to reduce false positives. ↗
·The Snort/Suricata rule (SID 2064112) uses a fixed URI bsize of 23 bytes for /dws/api/fileaccess.cgi. Ensure your IDS/IPS engine supports the bsize keyword (Suricata 4.x+); older engines may require adjustment.
·The PCRE in the detection rule anchors on the absence of '&' (\x26) before shell metacharacters, meaning URL-encoded variants (%3B, %0A, %60, %7C, %24) are also covered. Validate that your inspection engine decodes the request body before matching if normalization is not automatic.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.