CVE-2018-25115

This flaw lets someone send a specially crafted request to a router page and get the router to run hidden system commands. Because the commands run with the router’s highest privileges, a successful attacker can fully control the device—like having a master key to your office network.

This matters if your business uses one of the affected D-Link routers: dir-645, dir-600, dir-110, dir-412, dir-610, dir-615, dir-815 (and the listed dir-110/dir-412/dir-600 firmware). It only becomes a risk when the router is running vulnerable firmware and the service.cgi endpoint is reachable over the network (for example, exposed to the internet). An attacker does not need a login, and no user action is required.

This is urgent because attackers can remotely execute commands without authentication—meaning a simple network reachability check can lead to full device compromise. The vulnerability is confirmed to have publicly available proof-of-concept code, and the likelihood signals are rising. Treat internet-reachable affected routers as compromised-risk until proven otherwise and act immediately to block external access and replace/upgrade.

1. Confirm exposure and device identity

   • Identify which router model you use (dir-645, dir-600, dir-110, dir-412, dir-610, dir-615, dir-815).
   • Check the router’s firmware version and whether it matches any known vulnerable state for dir-110 firmware, dir-412 firmware, or dir-600 firmware.
   • Determine whether the router’s web/maintenance endpoint can be reached from outside your network (for example, whether port-forwarding, DMZ hosting, or remote admin exposes it to the public internet).

2. Immediate containment if you have an affected router

   • Restrict network access so service.cgi (router web maintenance) is not reachable from the public internet.
   • Use network controls (firewall rules) to limit inbound access to only trusted sources (e.g., your office IP or VPN).

3. Remediation (the real fix)

   • Replace the router or upgrade to a non-vulnerable, supported firmware version.
   • If your DIR series model is out of support (as these are reported to be), replacement is typically the practical path.

4. Post-change verification

   • From an external network (e.g., a phone hotspot), verify that the router’s maintenance endpoint is no longer reachable.
   • Confirm that normal business connectivity still works and that admin access is only available through your controlled paths (internal network/VPN).

5. What to monitor

   • Router configuration changes (new port forwards, altered DNS settings, unexpected admin changes).
   • Unusual outbound traffic from the router (unexpected connections that would not occur in normal operation).

Note: CISA KEV listing was not found for this CVE in the provided findings, so your action should be based on exposure + vulnerable firmware, not on KEV status.

Severity is very high: remote attackers can execute arbitrary system commands with root privileges, effectively taking over the router.

Weakness: CWE-78 (improper neutralization of special elements used in an OS command).

Attack vector/mechanism: An unauthenticated attacker sends a crafted HTTP request to the router’s service.cgi endpoint; the EVENT=CHECKFW parameter is not properly sanitized and is passed to the system shell, enabling command injection.

Reachability: Default configuration is reported as reachable (so internet exposure is the key gating factor). No authentication and no user interaction are required.

Exploitation status: Public proof-of-concept exists (2 known). CISA KEV was not listed in the provided findings.

Predicted likelihood: A rising EPSS-style prediction is present in the findings, but exploitation/weaponization is already demonstrated by public PoC availability; treat any reachable vulnerable device as high risk.

Fixed version: The provided findings do not list an exact fixed firmware version; remediation guidance centers on compensating controls (restrict remote access via firewall) and updating/replacing the device.