LOW
D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection
Published Sep 1, 2025
2.4
LOWCVSS 4.0
EPSS 27.04%
Description
A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.
Affected products
-
- Version 19.12.25A1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| D-Link | n/a | n/a |
|
AND
- 19.12.25a1
Running on/with
- v2.a1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (8)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28889 Advisory
- https://github.com/xyh4ck/iot_poc exploitThird Party Advisory
- https://github.com/xyh4ck/iot_poc#vulnerability-verification-process exploitThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-9769
- https://vuldb.com/?ctiid.322069 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.322069 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.640779 third-party-advisoryThird Party AdvisoryVDB Entry
- https://www.dlink.com/ product
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28889 | Advisory | |
| https://github.com/xyh4ck/iot_poc | exploitThird Party Advisory | |
| https://github.com/xyh4ck/iot_poc#vulnerability-verification-process | exploitThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2025-9769 | ||
| https://vuldb.com/?ctiid.322069 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.322069 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.640779 | third-party-advisoryThird Party AdvisoryVDB Entry | |
| https://www.dlink.com/ | product |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Sep 1, 2025
Updated Sep 2, 2025
Reserved Aug 31, 2025
Link CVE-2025-9769
CISA Vulnrichment
Updated Sep 2, 2025
ENISA EUVD
EUVD-2025-28889 Assigner VulDB
Published Apr 29, 2026
Updated Apr 29, 2026
Exploited since n/a
Link EUVD-2025-28889