CVE-2025-69542

CRITICAL

D-Link DIR-895LA1 v102b07 - OS Command Injection via DHCP Hostname Parameter

Title source: llm

Description

A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal processing logic where the DHCP hostname parameter is directly concatenated into a system command without proper sanitization. When a DHCP client renews an existing lease with a malicious hostname, arbitrary commands can be executed with root privileges.

References (1)

Core 1

Core References

Third Party Advisory, Exploit

https://tzh00203.notion.site/D-Link-DIR895LA1-v102b07-Command-Injection-in-DHCPd-2d4b5c52018a80a1a5ccfb317b308861?source=copy_link

Scores

CVSS v3 9.8

EPSS 0.0250

EPSS Percentile 85.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-77

Status published

Products (1)

dlink/dir-895la1_firmware 102b07

Published Jan 09, 2026

Tracked Since Feb 18, 2026