CVE-2025-25743
Published: 12 February 2025
Summary
CVE-2025-25743 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-853 Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
D-Link DIR-853 A1 firmware version FW1.20B07 contains a command injection vulnerability in the SetVirtualServerSettings module, tracked as CVE-2025-25743. The flaw is classified under CWE-77 and carries a CVSS 3.1 score of 7.2, reflecting network-reachable exploitation that requires high privileges but no user interaction.
An authenticated administrator can supply crafted input to the affected module over the network, resulting in arbitrary command execution on the device with full impact to confidentiality, integrity, and availability. This allows an attacker who already possesses administrative credentials to take complete control of the router.
EPSS for the CVE rose from a low baseline after the February 2025 disclosure to a peak of 0.1089 on 2025-12-11 before receding to the current value of 0.0416, indicating a period of increased exploitation interest several months after publication. The single public reference is a technical disclosure note hosted on Notion that does not detail vendor patches or mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4132
Vulnerability details
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability enables arbitrary OS command execution on the Linux-based router firmware after admin authentication, directly mapping to Unix Shell.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection vulnerability by requiring input validation mechanisms in the SetVirtualServerSettings module to prevent arbitrary command execution.
Ensures timely remediation of the specific command injection flaw in the D-Link DIR-853 firmware through identification, reporting, and patching.
Reduces the attack surface by enforcing least privilege, limiting high-privilege administrative access required to exploit the vulnerability.