CVE-2025-13306CWE-74CWE-77CWE-78command-injection

CVE-2025-13306

Medium · published November 18, 2025

CVSS v3.1
6.3
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.08253 · 94.9th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-11-18T05:15Z
Affected products (4)
ProductVersionsFixed in
dlink/dwr-m920_firmwareall versions—
dlink/dwr-m921_firmwareall versions—
dlink/dir-822k_firmwareall versions—
dlink/dir-825m_firmwareall versions—
References (9)
https://github.com/LX-LX88/cve/issues/15 · [email protected]https://vuldb.com/?ctiid.332646 · [email protected]https://vuldb.com/?id.332646 · [email protected]https://vuldb.com/?submit.691813 · [email protected]https://vuldb.com/?submit.693805 · [email protected]https://vuldb.com/?submit.693807 · [email protected]https://vuldb.com/?submit.695426 · [email protected]https://www.dlink.com/ · [email protected]https://github.com/LX-LX88/cve/issues/15 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 NOV 23:32Z
    D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection
    cvelistv5