CVE-2025-55583

The fileaccess.cgi component exposes the endpoint /dws/api/UploadFile, which accepts the pre_api_arg parameter. The value of this parameter is passed directly to functions executing commands at the system shell level without any sanitization or authentication verification. An attacker can send a crafted HTTP request containing a malicious payload in the pre_api_arg parameter, resulting in the execution of arbitrary commands as root.

The attacker gains full control of the device with the highest privileges (root), which enables router takeover, network configuration modification, network traffic interception, and use of the device as an entry point to the internal network.

Patches available from the manufacturer should be applied according to references (D-Link Security Advisory SAP10397 available at supportannouncement.us.dlink.com). Until the update is deployed, it is recommended to restrict access to the router's management interface exclusively from trusted IP addresses and to disable remote access to the administrative panel from the WAN network side.

D-Link DIR-868L B1 with firmware version FW2.05WWb02