CVE-2025-15192: D-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injection
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fotaurl leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15192?
CVE-2025-15192 is classified as a high severity vulnerability due to its potential for remote command injection.
How do I fix CVE-2025-15192?
To mitigate CVE-2025-15192, update the D-Link DWR-M920 firmware to a version later than 1.1.50.
What systems are affected by CVE-2025-15192?
CVE-2025-15192 affects the D-Link DWR-M920 devices running firmware versions up to and including 1.1.50.
What type of attack is possible due to CVE-2025-15192?
CVE-2025-15192 allows for remote command injection attacks targeting the device's firmware update functionality.
Can CVE-2025-15192 be exploited remotely?
Yes, CVE-2025-15192 can be exploited remotely, allowing attackers to execute arbitrary commands on the affected device.