Vulnerability · Published Oct 8, 2025 · Assigned by VulDB
CVE-2025-11488D-Link DIR-852 HNAP1 command injection
High 7.3
In plain English
A high-severity command injection in DIR-852 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.6%top 23.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-327605 | D-Link DIR-852 HNAP1 command injection vdb-entry
- VDB-327605 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #667505 | D-Link DIR-852 A1 Command Injection third-party-advisory
- https://www.yuque.com/jh0ng/vmpda6/cqi681wr7vci6kx9 exploit
- https://www.dlink.com/ product