CVE-2025-69542

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal processing logic where the DHCP hostname parameter is directly concatenated into a system command without proper sanitization. When a DHCP client renews an existing lease with a malicious hostname, arbitrary commands can be executed with root privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-69559.8A vulnerability was found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown funCVE-2025-695599.8code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.CVE-2025-69569.8A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of tCVE-2025-695629.8code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.CVE-2025-695639.8code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.CVE-2025-695649.8code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, CVE-2025-695659.8code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php.CVE-2025-69579.8A vulnerability was found in Campcodes Employee Management System 1.0. It has been declared as critical. This vulnerability affects unknown CVE-2025-69589.8A vulnerability was found in Campcodes Employee Management System 1.0. It has been rated as critical. This issue affects some unknown procesCVE-2025-695815.5An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even afteCVE-2025-69599.8A vulnerability classified as critical has been found in Campcodes Employee Management System 1.0. Affected is an unknown function of the fiCVE-2025-695999.8RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.