cbcvebase.
CVE-2025-57105
published 2025-08-22

CVE-2025-57105: The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in…

PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.88%
85.2th percentile
The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host.

Affected

1 ranges
VendorProductVersion rangeFixed in
dlinkdi-7400g_+_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/mng_platform.asp
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link mng_platform.asp addr Parameter Command Injection Attempt (CVE-2025-57105, CVE-2025-9769)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mng_platform.asp|3f|"; startswith; fast_pattern; content:"addr|3d|"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/xyh4ck/iot_poc; reference:cve,2025-57105; reference:cve,2025-9769; classtype:attempted-admin; sid:2064110; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_22, cve CVE_2025_57105, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Monitor HTTP GET requests to /mng_platform.asp with the 'addr' parameter containing shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24), which indicate command injection attempts.
  • →The vulnerable parameter is 'ac_mng_srv_host' processed by sub_478D28 in mng_platform.asp and sub_4A12DC in wayos_ac_server.asp within the jhttpd program on D-Link DI-7400G+ routers. ↗
  • →Also monitor HTTP GET requests to /wayos_ac_server.asp with the same injection metacharacters in the ac_mng_srv_host parameter, as both ASP endpoints share the same vulnerability class (also tracked as CVE-2025-9769).
  • →Exploitation is expected over plaintext HTTP (not TLS) targeting networking equipment at the perimeter or internally; prioritize monitoring on perimeter-facing D-Link DI-7400G+ management interfaces.
  • ·The Snort/Suricata rule (sid:2064110) targets $HOME_NET as the destination, meaning it is designed for monitoring inbound traffic to internal/perimeter devices. Ensure $HOME_NET is correctly scoped to include D-Link DI-7400G+ management IPs to avoid missed detections.
  • ·The PCRE in the rule matches shell metacharacters only in the 'addr' parameter value up to the first '&' (ampersand), so URL-encoded chained parameters using '&' as a delimiter will not be caught beyond the first parameter boundary.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.