CVEvulnerability

CVE-2025-55581

7.3 HIGH Published 2025-08-22 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-08-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-269, CWE-306, CWE-494

Description

D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or permissions. An attacker with filesystem access (e.g., via UART or firmware modification) may replace these binaries to achieve persistent arbitrary code execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity checks in the watchdog logic.

Affected configurations

• dlink dcs-825l firmware (<= 1.08.01)

Related

Weakness · CWE (3)

  • CWE-269 Improper Privilege Management weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-494 Download of Code Without Integrity Check weakness

References