CVE-2025-57105

CriticalCVSS 9.8/10Last modified Jul 5, 2026

Description

The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/xyh4ck/iot_pocExploit, Third Party Advisory
https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2BProduct
https://www.dlink.com/en/security-bulletin/Not Applicable
https://github.com/xyh4ck/iot_pocExploit, Third Party Advisory

Timeline

Published: Aug 22, 2025
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-571067.5Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the B CVE-2025-571077.1Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing sp CVE-2025-571089.8Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability m CVE-2025-571096.5Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files CVE-2025-57117.3A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unk CVE-2025-571175.4A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScri CVE-2025-571189.8An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php CVE-2025-571199.8An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login CVE-2025-57127.3A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulne CVE-2025-57135.4A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown CVE-2025-571308.8An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker CVE-2025-57144.3A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part o