CVE-2025-15191: D-Link DWR-M920 formLtefotaUpgradeFibocom sub_4155B4 command injection
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fotaurl causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15191?
CVE-2025-15191 is a critical vulnerability due to its potential for remote command injection.
How do I fix CVE-2025-15191?
To fix CVE-2025-15191, upgrade the D-Link DWR-M920 to a version later than 1.1.50.
What are the potential impacts of exploiting CVE-2025-15191?
Exploiting CVE-2025-15191 can lead to unauthorized remote code execution on the affected device.
Which devices are affected by CVE-2025-15191?
CVE-2025-15191 affects D-Link DWR-M920 devices running versions up to and including 1.1.50.
How can I determine if my device is vulnerable to CVE-2025-15191?
You can determine if your device is vulnerable to CVE-2025-15191 by checking the firmware version against the known affected versions.