Medium severity6.3NVD Advisory· Published May 6, 2025· Updated Jun 17, 2026

CVE-2025-4340

Description

A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dlink/DIR-806llm-create2 versions
<=100CNb11/108B03+ 1 more
- (no CPE)range: <=100CNb11/108B03
- (no CPE)range: 100CNb11
Dlink/DIR-890Lllm-create2 versions
<=100CNb11/108B03+ 1 more
- (no CPE)range: <=100CNb11/108B03
- (no CPE)range: 100CNb11

Patches

Vulnerability mechanics

References

github.com/CH13hh/tmp_store_cc/blob/main/tt/1.mdnvdExploitThird Party Advisory
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions RequiredVDB Entry
www.dlink.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000