CVE-2025-13306

A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA
6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Common Weakness Enumeration
References
https://github.com/LX-LX88/cve/issues/15
https://vuldb.com/?ctiid.332646
https://vuldb.com/?id.332646
https://vuldb.com/?submit.691813
https://vuldb.com/?submit.693805
https://vuldb.com/?submit.693807
https://vuldb.com/?submit.695426
https://www.dlink.com/
https://github.com/LX-LX88/cve/issues/15