CVE-2025-12296: D-Link DAP-2695 Firmware Update sub_4174B0 os command injection

Published Oct 27, 2025

Updated

A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected Software

3 affected components

D-Link DAP-2695

All of the following

Dlink Dap-2695 Firmware=2.00-rc131

Dlink DAP-2695

Event History

Oct 27, 2025

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-12296?

CVE-2025-12296 is considered a high severity vulnerability due to its potential for remote command injection.

How do I fix CVE-2025-12296?

To fix CVE-2025-12296, update the D-Link DAP-2695 firmware to the latest version provided by D-Link.

What does CVE-2025-12296 exploit?

CVE-2025-12296 exploits the firmware update handler function within the D-Link DAP-2695.

Can CVE-2025-12296 be exploited remotely?

Yes, CVE-2025-12296 can be exploited remotely by an attacker.

What type of vulnerability is CVE-2025-12296?

CVE-2025-12296 is classified as an operating system command injection vulnerability.