CVE-2025-15245

LOW

D-Link DCS-850L 1.02.09 - Path Traversal via Firmware Update DownloadFile Parameter

Title source: llm

Description

A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.338635

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.338635

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.725742

Exploit, Third Party Advisory exploit patch

https://tzh00203.notion.site/D-Link-DCS850L-v1-02-09-Path-Traversal-Vulnerability-in-Firmware-Update-2d8b5c52018a803abbc7e30e2858d084?source=copy_link

Product broken-link product

https://www.dlink.com/

Scores

CVSS v3 3.5

EPSS 0.0008

EPSS Percentile 24.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

dlink/dcs-850l_firmware 1.02.09

Published Dec 30, 2025

Tracked Since Feb 18, 2026