CVE-2025-11488
BaseFortify
Publication date: 2025-10-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| d-link | dir-852 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11488 is a critical command injection vulnerability in the D-Link DIR-852 router, affecting firmware versions up to 20251002. The flaw exists in the /HNAP1/ interface, where improper handling of external input allows remote attackers to execute arbitrary commands without authentication. This happens because the device constructs commands using external input without properly neutralizing special characters, enabling attackers to alter command execution remotely. [2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing remote attackers to execute arbitrary commands on your D-Link DIR-852 router without any authentication. This compromises the confidentiality, integrity, and availability of the device, potentially allowing attackers to take full control, disrupt network services, or steal sensitive information. Since the affected products are no longer supported and no mitigations exist, the risk is heightened. [2]
What immediate steps should I take to mitigate this vulnerability?
Since no known mitigations or countermeasures exist and the affected product is no longer supported by the vendor, the recommended immediate step is to replace the affected D-Link DIR-852 device with a secure and supported alternative to prevent exploitation. [2]