CVE-2025-1392

LOW

D-Link DIR-816 1.01TO - Cross-Site Scripting via SSID Parameter

Title source: llm

Description

A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.501351

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.296023

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.296023

Product product

https://www.dlink.com/

Scores

CVSS v3 3.5

EPSS 0.0183

EPSS Percentile 83.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-94 CWE-79

Status published

Products (1)

dlink/dir-816_firmware 1.01to

Published Feb 17, 2025

Tracked Since Feb 18, 2026