CVE-2025-15191
📋 TL;DR
This CVE describes a command injection vulnerability in D-Link DWR-M920 routers that allows remote attackers to execute arbitrary commands by manipulating the fota_url parameter. The vulnerability affects all versions up to 1.1.50 and can be exploited without authentication. Attackers could potentially take full control of affected devices.
💻 Affected Systems
- D-Link DWR-M920
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, credential theft, and potential lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit code is available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: Yes
Instructions:
1. Check D-Link security advisories for firmware updates. 2. Download latest firmware from official D-Link support site. 3. Upload firmware through web interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Isolation
allPlace affected devices behind firewalls with strict inbound filtering to prevent external exploitation.
Access Control
allRestrict administrative access to trusted IP addresses only.
🧯 If You Can't Patch
- Immediately isolate affected devices from internet and critical internal networks
- Implement strict network segmentation to limit potential lateral movement
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under System > Firmware Information. If version is 1.1.50 or lower, device is vulnerable.Check Version:
Not applicable - check via web interface or consult device documentationVerify Fix Applied:
Verify firmware version is higher than 1.1.50 after applying any available updates.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formLtefotaUpgradeFibocom
- Suspicious command execution in system logs
- Multiple failed firmware update attempts
Network Indicators:
- Unusual outbound connections from router
- Traffic to unexpected external IPs
- Suspicious payloads in HTTP requests to router
SIEM Query:
source="router_logs" AND (uri="/boafrm/formLtefotaUpgradeFibocom" OR message="fota_url")🔗 References
- https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md
- https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md#poc
- https://vuldb.com/?ctiid.338576
- https://vuldb.com/?id.338576
- https://vuldb.com/?submit.723554
- https://www.dlink.com/
