CVE-2025-69542
Published: 09 January 2026
Summary
CVE-2025-69542 is a critical-severity Command Injection (CWE-77) vulnerability in Dlink Dir-895La1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69542 is a command injection vulnerability (CWE-77) affecting the DHCP daemon service in D-Link DIR895LA1 routers running firmware version v102b07. The flaw resides in the lease renewal processing logic, where the DHCP hostname parameter supplied by a client is directly concatenated into a system command without proper sanitization, enabling code execution.
Attackers with network access can exploit this vulnerability without authentication or user interaction, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By renewing an existing DHCP lease using a malicious hostname, an unauthenticated remote attacker can execute arbitrary commands on the router with root privileges, potentially leading to full device compromise, data theft, or further network pivoting.
Details on mitigation, including any patches or workarounds, are provided in the advisory at https://tzh00203.notion.site/D-Link-DIR895LA1-v102b07-Command-Injection-in-DHCPd-2d4b5c52018a80a1a5ccfb317b308861?source=copy_link.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1712
Vulnerability details
A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal processing logic where the DHCP hostname parameter is directly concatenated into a system command without proper sanitization.…
more
When a DHCP client renews an existing lease with a malicious hostname, arbitrary commands can be executed with root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in DHCP daemon enables unauthenticated remote exploitation of a network-accessible service (T1190) for arbitrary root Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection by requiring validation and sanitization of the DHCP hostname input before concatenation into system commands.
Addresses the specific flaw in the DHCP daemon's lease renewal processing through timely identification, reporting, and correction via patches or updates.
Restricts the types, sources, and quantity of hostname inputs to the DHCP service, limiting opportunities for malicious command injection payloads.