Critical severity9.8NVD Advisory· Published Aug 28, 2025· Updated Jun 17, 2026
CVE-2025-55583
CVE-2025-55583
Description
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:o:dlink:dir-868l_firmware:2.05b02:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- cybermaya.in/posts/Post-44/nvdExploitThird Party Advisory
- supportannouncement.us.dlink.com/security/publication.aspxnvdProduct
- www.dlink.com/en/security-bulletin/nvdNot Applicable
News mentions
2- Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 ProxiesThe Hacker News · Aug 17, 2026
- New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into ProxiesInfosecurity Magazine · Aug 14, 2026