CVE-2025-5492 D-Link DI-500WF-WT /usr/sbin/jhttpd msp_info.htm sub_456DE8 command injection
Remote attackers can execute arbitrary commands on D-Link DI-500WF-WT routers via the jhttpd service, requiring immediate attention from network administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5492?
CVE-2025-5492 is a medium-severity command injection vulnerability in D-Link DI-500WF-WT, published on 3 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub_456DE8 of the file /msp_info.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. The attack can be launched remotely.
Which versions are affected by CVE-2025-5492?
It affects 1 product.
Products include Dlink Di-500wf-Wt Firmware.
How do I fix CVE-2025-5492?
No fix has been published for CVE-2025-5492 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-5492 being exploited?
There is no known exploitation of CVE-2025-5492 in the wild and no public exploit code.
Sources
Also known as GHSA-8jv6-3xj6-gq9g.