CVE-2025-8231

CWE-259 CWE-798 — Hard-coded Credentials CWE-416 — Use After Free4 documents4 sources

Severity

7.0HIGH

EPSS

0.1%

top 68.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-890l Firmware D-link Dir-890l

Timeline

PublishedJul 27

Description

A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04. This issue affects some unknown processing of the file rgbin of the component UART Port. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDdlink/dir-890l_firmware1.11b04

▶CVEListV5d-link/dir-890l111b04

🔴Vulnerability Details

GHSA

GHSA-85q8-9fqg-6jwh: A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04↗2025-07-27

▶

CVEList

D-Link DIR-890L UART Port rgbin hard-coded credentials↗2025-07-27

▶

📋Vendor Advisories

Microsoft

Due to use of a dangling pointer libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.↗2020-12-08

▶