CVE-2025-55583

CRÍTICO 9.8CVE-2025-55583 · Published 28/08/2025 · updated 17/06/2026

En resumen

CVE-2025-55583 es una vulnerabilidad CRÍTICO (CVSS 9.8).
Probabilidad de explotación en los próximos 30 días (EPSS): 7.0%, mayor que el 94.1% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

References

cybermaya.in/posts/Post-44 · Exploit
supportannouncement.us.dlink.com/security/publication.aspx · Product
dlink.com/en/security-bulletin · Not Applicable

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free