Sign-up

ID

VAR-202506-0305


CVE

CVE-2025-5571


TITLE

D-Link DCS-932L setSystemAdmin file command injection vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-12283

DESCRIPTION

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin. The manipulation of the argument AdminID leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link DCS-932L is a network surveillance camera from D-Link, a Chinese company. It is used for security and monitoring. D-Link DCS-932L has a command injection vulnerability. The vulnerability is caused by the parameter AdminID in the file /setSystemAdmin failing to properly filter special characters and commands in the constructed command. No detailed vulnerability details are currently provided

Trust: 1.44

sources: NVD: CVE-2025-5571 // CNVD: CNVD-2025-12283

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-12283

AFFECTED PRODUCTS

vendor:d linkmodel:dcs-932lscope:eqversion:2.18.01

Trust: 0.6

sources: CNVD: CNVD-2025-12283

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-5571
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2025-12283
value: MEDIUM

Trust: 0.6

cna@vuldb.com: CVE-2025-5571
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2025-12283
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-5571
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-12283 // NVD: CVE-2025-5571

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:CWE-77

Trust: 1.0

sources: NVD: CVE-2025-5571

EXTERNAL IDS

db:NVDid:CVE-2025-5571

Trust: 1.6

db:VULDBid:311028

Trust: 1.0

db:CNVDid:CNVD-2025-12283

Trust: 0.6

sources: CNVD: CNVD-2025-12283 // NVD: CVE-2025-5571

REFERENCES

url:https://github.com/wudipjq/my_vuln/blob/main/d-link5/vuln_42/42.md

Trust: 1.6

url:https://vuldb.com/?submit.588465

Trust: 1.0

url:https://vuldb.com/?id.311028

Trust: 1.0

url:https://vuldb.com/?ctiid.311028

Trust: 1.0

url:https://www.dlink.com/

Trust: 1.0

sources: CNVD: CNVD-2025-12283 // NVD: CVE-2025-5571

SOURCES

db:CNVDid:CNVD-2025-12283
db:NVDid:CVE-2025-5571

LAST UPDATE DATE

2025-06-15T23:46:35.383000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-12283date:2025-06-12T00:00:00
db:NVDid:CVE-2025-5571date:2025-06-04T14:54:33.783

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-12283date:2025-06-12T00:00:00
db:NVDid:CVE-2025-5571date:2025-06-04T06:15:22.190