CVE-2025-5571CWE-77CWE-78

D-Link DCS-932L setSystemAdmin os command injection

Medium · published June 4, 2025

CVSS v4.0

5.3

EPSS

14%

Percentile

96.5

In the wild

Unconfirmed

What it is

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin. The manipulation of the argument AdminID leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS: 0.13936 · 96.5th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-06-04T05:31Z

EPSS history

Timeline

04 JUN 05:31Z
D-Link DCS-932L setSystemAdmin os command injection
cvelistv5