CVEvulnerability

CVE-2025-9745

2.0 LOW Published 2025-08-31 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-08-31
Last modified
2026-10-18
Assigner
[email protected]
CVSS 4.0 ([email protected])
2.0 LOW — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:L/Au:M/C:P/I:P/A:P
Weaknesses
CWE-77, CWE-78

Description

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Affected configurations

• dlink di-500wf firmware 14.04.10a1t

Related

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References