Cyber Posture

CVE-2025-22968

CriticalPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
21 May 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.4206 97.5th percentile
Risk Priority 45 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

Security Summary

CVE-2025-22968 is a critical vulnerability (CVSS score 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) published on 2025-01-15, affecting the D-Link DWR-M972V router on firmware version 1.05SSG. Classified under CWE-94 (code injection), the issue enables a remote attacker to execute arbitrary code via SSH by leveraging the root account without any restrictions.

Any unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation provides root-level arbitrary code execution on the device, resulting in high-impact compromise of confidentiality, integrity, and availability.

Advisories and further details, including potential patches or mitigations, are referenced on D-Link's security bulletin page at https://www.dlink.com/en/security-bulletin/, along with GitHub repositories https://github.com/CRUNZEX/CVE-2025-22968 and https://github.com/CRUNZEX/CVE-DLINK-LTE containing exploit-related information.

Details

CWE(s)
CWE-94

Affected Products

dlink
dwr-m972v firmware
1.05ssg

MITRE ATT&CK Enterprise Techniques

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Why these techniques?

The vulnerability provides unauthenticated root access via SSH (and Telnet) on exposed WAN/LAN ports, facilitating default account abuse (T1078.001), command execution through network device CLI (T1059.008), and initial access via external remote services (T1133).

References