Vulnerability Description
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-868L Firmware | 2.05b02 |
| Dlink | Dir-868L | b1 |
Related Weaknesses (CWE)
References
- https://cybermaya.in/posts/Post-44/ExploitThird Party Advisory
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397Product
- https://www.dlink.com/en/security-bulletin/Not Applicable
- https://cybermaya.in/posts/Post-44/ExploitThird Party Advisory
FAQ
What is CVE-2025-55583?
CVE-2025-55583 is a vulnerability with a CVSS score of 9.8 (CRITICAL). D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_ap...
How severe is CVE-2025-55583?
CVE-2025-55583 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-55583?
Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-868L Firmware, Dlink Dir-868L.