CVE-2025-9769

D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection

State: Published
Severity: 2.4 Low
Published: Sep 1, 2025
Updated: Sep 2, 2025
Reserved: Aug 31, 2025

Description

A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.1 Medium	CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	4.1 Medium	CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
DI-7400G+D-Link	19.12.25A1Affected

References

VDB-322069 | D-Link DI-7400G+ mng_platform.asp sub_478D28 command injectionvdb-entrytechnical-description
VDB-322069 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #640779 | D-Link DI-7400G+ 19.12.25A1 Command Injectionthird-party-advisory
https://github.com/xyh4ck/iot_pocexploit
https://github.com/xyh4ck/iot_poc#vulnerability-verification-processexploit
https://www.dlink.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.