ID
VAR-202505-0264
CVE
CVE-2025-4340
TITLE
D-Link Systems, Inc. of DIR-806 firmware and DIR-890L Command injection vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DIR-806 firmware and DIR-890L Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-890L and D-Link DIR-806A1 are both products of D-Link. D-Link DIR-890L is a wireless router. D-Link DIR-806A1 is a dual-band wireless router that supports AC750 wireless rate and USB sharing function. The vulnerability is caused by the function sub_175C8 in the file /htdocs/soap.cgi failing to properly filter the special characters and commands of the constructed command. Attackers can use this vulnerability to execute arbitrary commands
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | dlink | model: | dir-890l | scope: | lte | version: | 1.08b03 | Trust: 1.0 |
| vendor: | dlink | model: | dir-806 | scope: | lte | version: | 100cnb11 | Trust: 1.0 |
| vendor: | d link | model: | dir-890l | scope: | - | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dir-806 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dir-806a1 <=108b03 | scope: | - | version: | - | Trust: 0.6 |
| vendor: | d link | model: | dir-890l <=100cnb11 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-74 | Trust: 1.0 |
| problemtype: | CWE-77 | Trust: 1.0 |
| problemtype: | injection (CWE-74) [ others ] | Trust: 0.8 |
| problemtype: | Command injection (CWE-77) [ others ] | Trust: 0.8 |
| problemtype: | Command injection (CWE-77) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-4340 | Trust: 3.2 |
| db: | VULDB | id: | 307458 | Trust: 2.4 |
| db: | JVNDB | id: | JVNDB-2025-004922 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-11229 | Trust: 0.6 |
REFERENCES
| url: | https://vuldb.com/?id.307458 | Trust: 2.4 |
| url: | https://github.com/ch13hh/tmp_store_cc/blob/main/tt/1.md | Trust: 1.8 |
| url: | https://vuldb.com/?submit.556092 | Trust: 1.8 |
| url: | https://www.dlink.com/ | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.307458 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-4340 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-11229 |
| db: | JVNDB | id: | JVNDB-2025-004922 |
| db: | NVD | id: | CVE-2025-4340 |
LAST UPDATE DATE
2025-06-02T23:30:31.698000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-11229 | date: | 2025-05-30T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-004922 | date: | 2025-05-14T06:26:00 |
| db: | NVD | id: | CVE-2025-4340 | date: | 2025-05-13T20:25:29.913 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-11229 | date: | 2025-05-30T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-004922 | date: | 2025-05-14T00:00:00 |
| db: | NVD | id: | CVE-2025-4340 | date: | 2025-05-06T08:15:18.340 |