CVE-2025-15245
📋 TL;DR
This vulnerability allows local network attackers to perform path traversal attacks via the firmware update service in D-Link DCS-850L cameras. By manipulating the DownloadFile argument, attackers can potentially write files to arbitrary locations on the device. Only DCS-850L version 1.02.09 is affected, and these products are no longer supported by the vendor.
💻 Affected Systems
- D-Link DCS-850L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could overwrite critical system files, potentially gaining persistent access, bricking the device, or executing arbitrary code with elevated privileges.
Likely Case
Local network attackers could upload malicious firmware or configuration files to compromise the camera, potentially gaining video access or using it as a foothold for further attacks.
If Mitigated
With proper network segmentation and access controls, the impact is limited to the camera device itself without lateral movement opportunities.
🎯 Exploit Status
The exploit has been made public according to the description, and path traversal vulnerabilities typically have straightforward exploitation paths once the attack vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
No official patch is available since the product is no longer supported. Consider the workarounds and risk reduction steps below.
🔧 Temporary Workarounds
Disable firmware update service
allIf possible, disable the firmware update functionality in the camera's web interface to remove the attack vector.
Network isolation
allPlace the camera on a dedicated VLAN or network segment with strict access controls.
🧯 If You Can't Patch
- Segment the camera network - Place all DCS-850L cameras on a dedicated VLAN with no access to other critical systems
- Implement network access controls - Use firewall rules to restrict which devices can communicate with the cameras on port 80/443
🔍 How to Verify
Check if Vulnerable:
Check the camera's firmware version via the web interface at Settings > System > Firmware Update. If version is 1.02.09, the device is vulnerable.Check Version:
Connect to camera web interface and navigate to firmware settings, or use curl: curl -s http://[camera-ip]/config/get?section=versionVerify Fix Applied:
Since no patch is available, verify workarounds by confirming the camera is on an isolated network segment and that network access controls are properly configured.📡 Detection & Monitoring
Log Indicators:
- Unusual firmware update attempts
- HTTP requests to uploadfirmware endpoint with suspicious DownloadFile parameters
- Failed firmware update attempts from unexpected sources
Network Indicators:
- HTTP POST requests to /uploadfirmware or similar endpoints with path traversal patterns in parameters
- Traffic to camera management ports from unauthorized IPs
SIEM Query:
source="camera-logs" AND (uri_path="/uploadfirmware" OR uri_path="/cgibin" AND method="POST") AND (param="DownloadFile" AND value CONTAINS "../")