CVE-2025-34125
Published: 16 July 2025
Summary
CVE-2025-34125 is a critical-severity OS Command Injection (CWE-78) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. The flaw, tracked as CVE-2025-34125 and assigned CWE-78, arises when specially crafted cookie values are processed, enabling execution of arbitrary commands on the underlying Linux operating system with a CVSS 4.0 score of 9.3.
Remote attackers can exploit the issue without authentication or user interaction by supplying malicious cookies over the network. Successful exploitation grants full system compromise on the affected device.
Public references include a Metasploit module for the vulnerability along with archived technical details and an Exploit-DB entry. The associated EPSS score stands at 0.7460 with an identical recorded peak, indicating sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21746
Vulnerability details
An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the…
more
underlying Linux operating system. Successful exploitation enables full system compromise.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.