CVE-2025-25743
Published: 12 February 2025
Summary
CVE-2025-25743 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-853 Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the command injection vulnerability by requiring input validation mechanisms in the SetVirtualServerSettings module to prevent arbitrary command execution.
Ensures timely remediation of the specific command injection flaw in the D-Link DIR-853 firmware through identification, reporting, and patching.
Reduces the attack surface by enforcing least privilege, limiting high-privilege administrative access required to exploit the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability enables arbitrary OS command execution on the Linux-based router firmware after admin authentication, directly mapping to Unix Shell.
NVD Description
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.
Deeper analysisAI
CVE-2025-25743 is a command injection vulnerability (CWE-77) affecting the D-Link DIR-853 router running firmware version A1 FW1.20B07. The flaw resides in the SetVirtualServerSettings module, where insufficient input validation allows arbitrary command execution. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Exploitation requires high privileges (PR:H), such as authenticated administrative access, and can be performed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). A successful attack enables an attacker to execute arbitrary commands on the underlying operating system, potentially leading to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged scope (S:U), such as full device compromise, data exfiltration, or persistent backdoor installation.
The primary advisory reference is available at https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-1812386a664480229910c137ded2d3f1, which details the vulnerability discovery but does not specify patches or mitigations in the provided information. Security practitioners should check for firmware updates from D-Link and restrict administrative access to trusted networks.
Details
- CWE(s)