CVE-2018-25115

Name: CVE-2018-25115
Creator: NVD / NIST
Published: 2025-08-27T22:15:31.37+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 10/10EPSS 8.67%

Last modified Jun 17, 2026

CVE-2018-25115 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. EPSS estimates a 8.67% chance of exploitation in the next 30 days.

Description

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0

10/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

8.67%

94.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Dlink	Dir-110 Firmware	All versions
Dlink	Dir-412 Firmware	All versions
Dlink	Dir-600 Firmware	All versions
Dlink	Dir-610 Firmware	All versions
Dlink	Dir-615 Firmware	All versions
Dlink	Dir-645 Firmware	All versions
Dlink	Dir-815 Firmware	1.03

References

https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rceExploit
https://legacy.us.dlink.com/Product
https://support.dlink.com/EndOfLifePolicy.aspxProduct
https://www.exploit-db.com/exploits/43496Exploit
https://www.vulncheck.com/advisories/dlink-dir-rce-service-cgiThird Party Advisory

Timeline

Published: Aug 27, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2018-25115?

How severe is CVE-2018-25115?

CVE-2018-25115 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 8.67% probability of exploitation in the next 30 days.

How do I fix CVE-2018-25115?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-25115?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST