CVE-2025-15357: D-Link DI-7400G+ msp_info.htm command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-30 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.

Affected products

D-Link DI-7400G+: 19.12.25a1

References

https://github.com/xyh4ck/iot_poc/tree/main/D-Link_DI_7400G%2B_Command_Injection
https://vuldb.com/?ctiid.338743
https://vuldb.com/?id.338743
https://vuldb.com/?submit.726376
https://www.dlink.com/

Get alerted when CVE-2025-15357 or the next vulnerability affects your stack