Secuno
ENNL
Book demo

CVE-2018-25115

D-Link Dir-815 Firmware command injection

9.8 CRITICALPublic exploitEPSS 10.1%
  1. Published27 Aug 2025

Description

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

D-Link Dir-110 Firmwareall versions
D-Link Dir-412 Firmwareall versions
D-Link Dir-600 Firmwareall versions
D-Link Dir-610 Firmwareall versions
D-Link Dir-615 Firmwareall versions
D-Link Dir-645 Firmwareall versions
D-Link Dir-815 Firmware1.03

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-185298.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is…
CVE-2025-714299.8
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in…
CVE-2020-372798.1
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that…
CVE-2026-1093188.8
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that…
CVE-2026-1088969.9
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function…
CVE-2026-1088959.9
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is…

Frequently asked

Is CVE-2018-25115 being actively exploited?

CVE-2018-25115 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 10.1%.

How severe is CVE-2018-25115?

CVE-2018-25115 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 10.1% probability of exploitation.

Which products are affected by CVE-2018-25115?

Affected products include D-Link Dir-110 Firmware, D-Link Dir-412 Firmware, D-Link Dir-600 Firmware, D-Link Dir-610 Firmware, D-Link Dir-615 Firmware, and 2 more.

How do I fix CVE-2018-25115?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-25115 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.