CVE-2018-25120 D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test
Unauthenticated remote attackers can execute arbitrary shell commands as root via the Mail Test endpoint on D-Link DNS-343 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25120?
CVE-2018-25120 is a critical command injection vulnerability in D-Link DNS-343 ShareCenter, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.
Weakness: CWE-78
Which versions are affected by CVE-2018-25120?
It affects 1 product.
Products include Dlink Dns-343 Firmware.
How do I fix CVE-2018-25120?
No fix has been published for CVE-2018-25120 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-25120 being exploited?
There is no known exploitation of CVE-2018-25120 in the wild and no public exploit code.
Sources
Also known as GHSA-3r6w-f62x-hc2h.