CVE-2025-9745
📋 TL;DR
This CVE describes an OS command injection vulnerability in D-Link DI-500WF routers that allows remote attackers to execute arbitrary commands on affected devices. The vulnerability exists in the jhttpd component's /version_upgrade.asp file and can be exploited by manipulating the 'path' argument. Organizations and individuals using the affected router model are at risk.
💻 Affected Systems
- D-Link DI-500WF
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Attacker gains shell access to router, modifies configurations, intercepts traffic, or uses device as pivot point for further attacks.
If Mitigated
Limited impact due to network segmentation, firewall rules, or lack of internet exposure.
🎯 Exploit Status
Public proof-of-concept available on GitHub; exploitation appears straightforward based on disclosed details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check D-Link support site for firmware updates
2. Download latest firmware if available
3. Upload via router admin interface
4. Reboot router after update
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers from critical networks and internet exposure
Firewall Rules
allBlock external access to router admin interface and restrict internal access
🧯 If You Can't Patch
- Replace affected routers with supported models
- Implement strict network segmentation and access controls
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface; if version is 14.04.10A1T, device is vulnerable.Check Version:
Check router web interface or use: curl -s http://router-ip/version_upgrade.aspVerify Fix Applied:
Verify firmware version has been updated to a version later than 14.04.10A1T.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /version_upgrade.asp
- Suspicious command execution in system logs
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
- Port scanning originating from router
SIEM Query:
source="router-logs" AND (uri="/version_upgrade.asp" OR command="*;*" OR command="*|*")🔗 References
- https://github.com/physicszq/Routers/blob/main/tmp/01/poc.py
- https://github.com/physicszq/Routers/tree/main/tmp/01
- https://vuldb.com/?ctiid.322044
- https://vuldb.com/?id.322044
- https://vuldb.com/?submit.640394
- https://www.dlink.com/
- https://github.com/physicszq/Routers/blob/main/tmp/01/poc.py
- https://github.com/physicszq/Routers/tree/main/tmp/01
