CVE-2025-15245

Vulnerability

Overview A path traversal vulnerability exists in the uploadfirmware function of D-Link DCS-850L camera firmware version 1.02.09 [1]. The flaw is triggered by manipulating the DownloadFile argument, which does not properly sanitize user input, allowing directory traversal sequences.

Exploitation

The attack requires the attacker to be on the same local network as the vulnerable device. No authentication is mentioned, so the function may be accessible without credentials. A public exploit has been released, increasing the risk of active attacks against unsupported devices.

Impact

Successful exploitation enables an attacker to traverse directories on the device, potentially leading to unauthorized file access or modification. In the context of a firmware update service, this could allow the upload of malicious firmware or extraction of sensitive files.

Mitigation

The D-Link DCS-850L is an end-of-life product no longer supported by the vendor [1]. No patch will be released. Users are advised to replace the device or implement network segmentation to limit exposure.