CVE-2025-25743

CVE-2025-25743 is a command injection vulnerability (CWE-77) affecting the D-Link DIR-853 router running firmware version A1 FW1.20B07. The flaw resides in the SetVirtualServerSettings module, where insufficient input validation allows arbitrary command execution. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Exploitation requires high privileges (PR:H), such as authenticated administrative access, and can be performed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). A successful attack enables an attacker to execute arbitrary commands on the underlying operating system, potentially leading to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged scope (S:U), such as full device compromise, data exfiltration, or persistent backdoor installation.

The primary advisory reference is available at https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-1812386a664480229910c137ded2d3f1, which details the vulnerability discovery but does not specify patches or mitigations in the provided information. Security practitioners should check for firmware updates from D-Link and restrict administrative access to trusted networks.