Cyber Posture

CVE-2025-15357

MediumPublic PoC

Published: 30 December 2025

Published
30 December 2025
Modified
09 January 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0012 31.1th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and…

more

could be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of the 'cmd' argument in /msp_info.htm to prevent command injection exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and patching of the specific command injection flaw in D-Link DI-7400G+ firmware version 19.12.25A1.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning to identify CVE-2025-15357 in deployed routers, enabling remediation before public exploit usage.

Security SummaryAI

CVE-2025-15357 is a command injection vulnerability affecting the D-Link DI-7400G+ router on firmware version 19.12.25A1. The flaw resides in an unknown function within the file /msp_info.htm?flag=cmd, where manipulation of the cmd argument enables command injection. It is classified under CWE-74 and CWE-77, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability is remotely exploitable by attackers possessing low privileges, such as authenticated users with basic access. Exploitation requires network connectivity and low attack complexity but no user interaction. Successful attacks can result in limited impacts, including partial disclosure of sensitive information, modification of data, and denial of some services through arbitrary command execution.

Advisories and references, including VulDB entries (ctiid.338743, id.338743, submit.726376) and the D-Link website, provide further details. A proof-of-concept exploit is publicly available on GitHub at xyh4ck/iot_poc/tree/main/D-Link_DI_7400G%2B_Command_Injection, indicating potential for immediate use by threat actors.

The exploit's public disclosure heightens the risk for exposed D-Link DI-7400G+ devices running the vulnerable firmware.

Details

CWE(s)
CWE-74CWE-77

Affected Products

dlink
di-7400g\+ firmware
19.12.25a1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection via web interface on public-facing router directly enables exploitation of public-facing application (T1190) and network device CLI command execution (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References