CVE-2025-34125
BaseFortify
Publication date: 2025-07-16
Last updated on: 2025-07-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lighttpd | lighttpd | 1.4.34 |
| d-link | dsp-w110a1 | 1.05b01 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unauthenticated command injection in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. It occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the underlying Linux operating system, potentially leading to full system compromise.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow remote attackers to execute arbitrary commands on the affected device without authentication, leading to full system compromise. This means attackers could take complete control over the device, potentially disrupting services, stealing data, or using the device as a foothold for further attacks.