CVE-2025-7836

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability classified as command injection has been identified in the D-Link DIR-816L router up to firmware version 2.06B01. It resides in the lxmldbc_system function within the /htdocs/cgibin file of the Environment Variable Handler component and is tracked under CWE-74 and CWE-77. The issue permits manipulation of environment variables that results in arbitrary command execution and carries a CVSS 4.0 score of 2.1 reflecting limited impact and low attack complexity.

The flaw can be triggered remotely by an authenticated attacker who supplies crafted input to the affected handler. Successful exploitation yields limited control over the device, allowing execution of injected commands without requiring user interaction. Public exploit code has already been disclosed, although the EPSS score remains flat at 0.0225 with no observed increase since publication.

The affected hardware is explicitly noted as unsupported by the vendor, and the sole reference to D-Link points to the company homepage without any accompanying patch or mitigation guidance. No evidence of in-the-wild exploitation is provided in the available references.