CVE-2025-12295
Published: 27 October 2025
Description
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
Security Summary
CVE-2025-12295 is a vulnerability involving improper verification of cryptographic signatures in the Firmware Update Handler component of D-Link DAP-2695 firmware version 2.00RC13. The issue resides in the function sub_40C6B8, classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-347 (Improper Verification of Cryptographic Signature). It carries a CVSS v3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating medium severity with network accessibility but high attack complexity and required high privileges.
The vulnerability enables remote exploitation where an attacker with high privileges can manipulate firmware updates to bypass signature checks, potentially leading to high confidentiality, integrity, and availability impacts. Attacks are described as highly complex with difficult exploitability, though a public exploit is available and could be used against affected devices.
References, including analyses on GitHub and VULDB, detail the flaw but note that it only impacts products no longer supported by D-Link, implying no official patches or mitigations are available. The D-Link website provides general product information but no specific advisory for this CVE. Security practitioners should isolate or decommission affected DAP-2695 devices.
Notable context includes the public availability of the exploit and its restriction to end-of-support hardware, increasing risks in legacy network environments without vendor maintenance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Firmware update handler vulnerability allows remote bypass of cryptographic signature verification (CWE-347), enabling exploitation of public-facing application (T1190), subversion of code signing controls (T1553.002), and modification of system firmware for persistence (T1542.001).