github.comTechnical descriptionexploit
https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce CVE-2018-25115
CRITICAL
D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
Record summary
CVE-2018-25115 has a selected CVSS score of 10.0 (critical); EIP currently links 1 catalogued exploit.
Description
Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Sep 6, 2023 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 28, 2025 · Source: CVE List
Affected products and versions
7| Product | Source | Version range | Status |
|---|---|---|---|
DIR-110Browse D-Link / DIR-110Default status: unknown | CVE List | * | affected |
DIR-412Browse D-Link / DIR-412Default status: unknown | CVE List | * | affected |
DIR-600Browse D-Link / DIR-600Default status: unknown | CVE List | * | affected |
DIR-615Browse D-Link / DIR-615Default status: unknown | CVE List | * | affected |
DIR-645Browse D-Link / DIR-645Default status: unknown | CVE List | * | affected |
DIR-815Browse D-Link / DIR-815Default status: unknown | CVE List | 1.03 | affected |
dir-110_firmwareBrowse D-Link / dir-110_firmware | VulnCheck | Version data not supplied | |
Proofs of concept
1Catalogued exploits
ExploitDBD-Link Routers 110/412/615/815 < 1.03 - 'service.cgi' Arbitrary Code ExecutionExploitDB exploitby Cr0n1cNot analyzed1 file
References
6legacy.us.dlink.comproduct
https://legacy.us.dlink.com/ nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-25115 support.dlink.comproduct
https://support.dlink.com/EndOfLifePolicy.aspx exploit-db.comexploit
https://www.exploit-db.com/exploits/43496 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/dlink-dir-rce-service-cgi