VULNERABILITY INTELLIGENCE

CVE-2025-4340

CVSS score6.3 MEDIUM

EPSS probability5.25%

CISA KEVNot currently listed

Published2025-05-06

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Weakness classification

cna@vuldb.com: CWE-74
nvd@nist.gov: CWE-77

Primary references

cna@vuldb.com — Exploit, Third Party Advisory
cna@vuldb.com — Permissions Required, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Product
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory