CVE-2025-9769

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
D-Link	DI-7400G+	19.12.25A1

References

https://github.com/xyh4ck/iot_pocExploit, Third Party Advisory
https://github.com/xyh4ck/iot_poc#vulnerability-verification-processExploit, Third Party Advisory
https://vuldb.com/?ctiid.322069Permissions Required, VDB Entry
https://vuldb.com/?id.322069Third Party Advisory, VDB Entry
https://vuldb.com/?submit.640779Third Party Advisory, VDB Entry
https://www.dlink.com/Product
https://github.com/xyh4ck/iot_pocExploit, Third Party Advisory
https://github.com/xyh4ck/iot_poc#vulnerability-verification-processExploit, Third Party Advisory

Timeline

Published: Sep 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-97709.8A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2025-97719.8A security vulnerability has been detected in SourceCodester Eye Clinic Management System 1.0. Affected by this issue is some unknown functi CVE-2025-97729.8A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of CVE-2025-97736.1A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation CVE-2025-97744.3A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php.CVE-2025-97759.8A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulatio CVE-2025-97766.5The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Im CVE-2025-97787.0A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of t CVE-2025-97798.8A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /CVE-2025-97808.8A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQo CVE-2025-97818.8A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. CVE-2025-97828.8A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/for