PT-2025-20414 · D Link · Dns-320+1
CVE-2025-44023
·
Published
2025-05-08
·
Updated
2025-05-08
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
dlink DNS-320 version 1.00
dlink DNS-320LW version 1.01.0914.20212
Description
An issue allows an attacker to execute arbitrary code via the
account mgr.cgi component, specifically through the cgi chg admin pw function.Recommendations
For dlink DNS-320 version 1.00, consider disabling the
cgi chg admin pw function in the account mgr.cgi component until a patch is available.
For dlink DNS-320LW version 1.01.0914.20212, restrict access to the account mgr.cgi component to minimize the risk of exploitation.Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dns-320
Dns-320L