CVE-2018-25115 D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
Remote attackers can execute arbitrary system commands with root privileges on unsupported D-Link routers via the service.cgi endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25115?
CVE-2018-25115 is a critical command injection vulnerability in D-Link DIR-110, published on 27 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.
Weakness: CWE-78
Which versions are affected by CVE-2018-25115?
It affects 7 products.
Products include Dlink Dir-110 Firmware, Dlink Dir-412 Firmware, Dlink Dir-600 Firmware, Dlink Dir-610 Firmware, Dlink Dir-615 Firmware, Dlink Dir-645 Firmware and 1 more.
How do I fix CVE-2018-25115?
No fix has been published for CVE-2018-25115 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-25115 being exploited?
There is no known exploitation of CVE-2018-25115 in the wild and no public exploit code.
Sources
Also known as GHSA-f5fw-w387-r642.