CVE-2025-57105

The vulnerability exists in the jhttpd program, specifically in the sub_478D28 function handled by the mng_platform.asp file and in the sub_4A12DC function handled by the wayos_ac_server.asp file. The ac_mng_srv_host parameter passed to these functions is not properly validated or sanitized, which allows an attacker to inject malicious system commands. An attacker can send a specially crafted network request without the need for authentication and achieve command execution in the context of the jhttpd process.

An attacker can remotely gain full control over the device by executing arbitrary system commands — potentially obtaining access to configuration, data transmitted over the network, and enabling further lateral movement within the infrastructure.

Apply patches available from the manufacturer according to the references (https://www.dlink.com/en/security-bulletin/). Until the update is applied, it is recommended to restrict access to the device management interface only to trusted IP addresses and isolate the device from unauthorized network segments.

D-Link DI-7400G+ (versions specified in the manufacturer's references)