CVE-2025-12295CWE-345CWE-347

CVE-2025-12295

Medium · published October 27, 2025

CVSS v3.1
6.6
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation can lead to improper verification of cryptographic signature. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
Published
2025-10-27T21:15Z
Affected products (1)
ProductVersionsFixed in
dlink/dap-2695_firmwareall versions—
References (5)
https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Inte.md · [email protected]https://vuldb.com/?ctiid.329963 · [email protected]https://vuldb.com/?id.329963 · [email protected]https://vuldb.com/?submit.675854 · [email protected]https://www.dlink.com/ · [email protected]
EPSS history
Timeline
  • 27 OCT 16:32Z
    D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification
    cvelistv5