cveboard RSS feed

CVE-2018-25115

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2018
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

D-Link DIR-110/412/600/615/645/815 RCE via service.cgi

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

DIR-110

Vendor
D-Link
Product
DIR-110
Platforms
Unknown
Default status
unknown
DIR-110 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
*affectedUnavailableUnavailableUnavailableNone listed

DIR-412

Vendor
D-Link
Product
DIR-412
Platforms
Unknown
Default status
unknown
DIR-412 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
*affectedUnavailableUnavailableUnavailableNone listed

DIR-600

Vendor
D-Link
Product
DIR-600
Platforms
Unknown
Default status
unknown
DIR-600 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
*affectedUnavailableUnavailableUnavailableNone listed

DIR-615

Vendor
D-Link
Product
DIR-615
Platforms
Unknown
Default status
unknown
DIR-615 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
*affectedUnavailableUnavailableUnavailableNone listed

DIR-645

Vendor
D-Link
Product
DIR-645
Platforms
Unknown
Default status
unknown
DIR-645 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
*affectedUnavailableUnavailableUnavailableNone listed

DIR-815

Vendor
D-Link
Product
DIR-815
Platforms
Unknown
Default status
unknown
DIR-815 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.03affectedcustomUnavailableUnavailableNone listed