ID
VAR-202508-2473
CVE
CVE-2025-9745
TITLE
D-Link Corporation of DI-500WF in the firmware OS Command injection vulnerability
Trust: 0.8
DESCRIPTION
A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. D-Link Corporation of DI-500WF The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DI-500WF is a panel-mounted wireless access point (AP) primarily used for building wireless network coverage environments. It supports the 802.11n protocol and has a theoretical maximum transmission rate of 150Mbps. This vulnerability stems from the fact that the parameter `path` in the file `/version_upgrade.asp` fails to properly filter special characters and commands used in command construction. Detailed vulnerability information is not currently available
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | dlink | model: | di-500wf | scope: | eq | version: | 14.04.10a1t | Trust: 1.0 |
| vendor: | d link | model: | di-500wf | scope: | eq | version: | di-500wf firmware 14.04.10a1t | Trust: 0.8 |
| vendor: | d link | model: | di-500wf | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | d link | model: | di-500wf | scope: | - | version: | - | Trust: 0.8 |
| vendor: | d link | model: | d-link di-500wf 14.04.10a1t | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-78 | Trust: 1.0 |
| problemtype: | CWE-77 | Trust: 1.0 |
| problemtype: | Command injection (CWE-77) [ others ] | Trust: 0.8 |
| problemtype: | OS Command injection (CWE-78) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | OS Command injection (CWE-78) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-9745 | Trust: 3.2 |
| db: | VULDB | id: | 322044 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-013162 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-25751 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/physicszq/routers/blob/main/tmp/01/poc.py | Trust: 1.8 |
| url: | https://github.com/physicszq/routers/tree/main/tmp/01 | Trust: 1.8 |
| url: | https://vuldb.com/?id.322044 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.640394 | Trust: 1.8 |
| url: | https://www.dlink.com/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-9745 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.322044 | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2025-25751 |
| db: | JVNDB | id: | JVNDB-2025-013162 |
| db: | NVD | id: | CVE-2025-9745 |
LAST UPDATE DATE
2025-11-19T23:33:01.936000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-25751 | date: | 2025-10-30T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-013162 | date: | 2025-09-05T09:32:00 |
| db: | NVD | id: | CVE-2025-9745 | date: | 2025-09-04T16:47:38.047 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-25751 | date: | 2025-10-30T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-013162 | date: | 2025-09-05T00:00:00 |
| db: | NVD | id: | CVE-2025-9745 | date: | 2025-08-31T21:15:30.983 |