CVE-2025-6896

MEDIUM

D-Link DI-7300G+ 19.12.25A1 - OS Command Injection via wget_test.asp URL Parameter

Title source: llm
STIX 2.1

Description

A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.314388
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.314388
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.604441
Product product
https://www.dlink.com/

Scores

CVSS v3 6.3
EPSS 0.0207
EPSS Percentile 84.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
dlink/di-7300g\+_firmware 19.12.25a1
Published Jun 30, 2025
Tracked Since Feb 18, 2026