Details of VAR-202507-2333

ID

VAR-202507-2333

CVE

CVE-2025-7836

TITLE

D-Link Corporation of DIR-816L Injection Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-015215

DESCRIPTION

A vulnerability has been found in D-Link DIR-816L up to 2.06B01 and classified as critical. Affected by this vulnerability is the function lxmldbc_system of the file /htdocs/cgibin of the component Environment Variable Handler. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Corporation of DIR-816L The firmware contains injection and command injection vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-816L is a wireless router from D-Link of China. No detailed vulnerability details are currently available

Trust: 2.16

sources: NVD: CVE-2025-7836 // JVNDB: JVNDB-2025-015215 // CNVD: CNVD-2025-16869

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-16869

AFFECTED PRODUCTS

vendor:	dlink	model:	dir-816l	scope:	lt	version:	2.06b01	Trust: 1.0
vendor:	d link	model:	dir-816l	scope:	eq	version:	-	Trust: 0.8
vendor:	d link	model:	dir-816l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dir-816l	scope:	eq	version:	dir-816l firmware 2.06b01	Trust: 0.8
vendor:	d link	model:	dir-816l <=2.06b01	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-16869 // JVNDB: JVNDB-2025-015215 // NVD: CVE-2025-7836

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-7836
value:	LOW
Trust: 1.0
nvd@nist.gov:	CVE-2025-7836
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2025-015215
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-16869
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2025-7836
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-015215
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-16869
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-7836
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2025-7836
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2025-015215
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-16869 // JVNDB: JVNDB-2025-015215 // NVD: CVE-2025-7836 // NVD: CVE-2025-7836

PROBLEMTYPE DATA

problemtype:	CWE-74	Trust: 1.0
problemtype:	CWE-77	Trust: 1.0
problemtype:	injection (CWE-74) [ others ]	Trust: 0.8
problemtype:	Command injection (CWE-77) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-015215 // NVD: CVE-2025-7836

EXTERNAL IDS

db:	NVD	id:	CVE-2025-7836	Trust: 3.2
db:	VULDB	id:	316939	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-015215	Trust: 0.8
db:	CNVD	id:	CNVD-2025-16869	Trust: 0.6

sources: CNVD: CNVD-2025-16869 // JVNDB: JVNDB-2025-015215 // NVD: CVE-2025-7836

REFERENCES

url:	https://github.com/bananashipsbbq/cve/blob/main/d-link%20dir-816l%20remote%20arbitrary%20command%20execution%20vulnerability%20in%20ssdpcgi.md	Trust: 1.8
url:	https://vuldb.com/?id.316939	Trust: 1.8
url:	https://vuldb.com/?submit.617359	Trust: 1.8
url:	https://www.dlink.com/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-7836	Trust: 1.4
url:	https://vuldb.com/?ctiid.316939	Trust: 1.0

sources: CNVD: CNVD-2025-16869 // JVNDB: JVNDB-2025-015215 // NVD: CVE-2025-7836

SOURCES

db:	CNVD	id:	CNVD-2025-16869
db:	JVNDB	id:	JVNDB-2025-015215
db:	NVD	id:	CVE-2025-7836

LAST UPDATE DATE

2025-10-10T23:34:29.061000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-16869	date:	2025-07-25T00:00:00
db:	JVNDB	id:	JVNDB-2025-015215	date:	2025-10-07T04:52:00
db:	NVD	id:	CVE-2025-7836	date:	2025-10-03T18:38:18.867

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-16869	date:	2025-07-25T00:00:00
db:	JVNDB	id:	JVNDB-2025-015215	date:	2025-10-07T00:00:00
db:	NVD	id:	CVE-2025-7836	date:	2025-07-19T17:15:23.950