CVE-2025-22968

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions

Critical · published January 15, 2025

CVSS v3.1
9.8
EPSS
3%
Percentile
85.0
In the wild
Unconfirmed
What it is

🚨 A remote attacker can execute arbitrary code using the root account on D-Link DWR-M972V 1.05SSG, and there's zero protection in place! 🔥 Think of it like a restaurant where one waiter can access the kitchen without any checks. This is the kind of access that lets an attacker cook up a storm in your system without being stopped! This flaw is absolutely devastating — an attacker could take control of your device, manipulate configurations, steal sensitive information, or even disrupt your entire network. Essentially, it's like giving someone the master key to your entire establishment, allowing them to run wild!

Put simply

Think of it like a restaurant where one waiter can access the kitchen without any checks. This is the kind of access that lets an attacker cook up a storm in your system without being stopped! This vulnerability allows attackers to leverage SSH access to execute any command as a root user, bypassing all security checks. It's a serious breach that puts your entire device at risk.

What to do

This flaw is absolutely devastating — an attacker could take control of your device, manipulate configurations, steal sensitive information, or even disrupt your entire network. Essentially, it's like giving someone the master key to your entire establishment, allowing them to run wild! Immediately patch your D-Link DWR-M972V to version 1.06SSG or later to close this critical security gap. Additionally, consider disabling SSH access until the patch is applied and review your security practices for remote access. You've got this! By following these steps, you’ll regain control and fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02569 · 85.0th percentile
Published
2025-01-15T00:00Z
EPSS history
Timeline
  • 15 JAN 00:00Z
    An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions
    cvelistv5