CVE-2025-9769: D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection
A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub478D28 of the file /mngplatform.asp. The manipulation of the argument addr with the input echo 12345 > poc.txt results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9769?
CVE-2025-9769 is categorized as a command injection vulnerability, which can lead to serious security risks if exploited.
How do I fix CVE-2025-9769?
To fix CVE-2025-9769, update the D-Link DI-7400G+ firmware to the latest version provided by the manufacturer.
What is the impact of CVE-2025-9769 on the D-Link DI-7400G+?
CVE-2025-9769 allows authenticated attackers to execute arbitrary commands on the D-Link DI-7400G+ device.
Is the D-Link DI-7400G+ still safe to use with CVE-2025-9769 present?
The presence of CVE-2025-9769 significantly compromises the security of the D-Link DI-7400G+, making it unsafe unless patched.
How can I determine if my D-Link DI-7400G+ is vulnerable to CVE-2025-9769?
Check the firmware version of your D-Link DI-7400G+ against the vulnerability report, and look for indications of the affected version 19.12.25A1.