D-Link DIR-852 CVE-2025-11488

Q: What is the CVSS score of CVE-2025-11488?

CVE-2025-11488 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-08 cna@vuldb.com

Command Injection D-Link

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated command injection typically grants full control of the underlying device, justifying high impact for all security properties.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:58 vuln.today

DescriptionCVE.org

A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.

Technical ContextAI

HNAP (Home Network Administration Protocol) is a SOAP-based protocol used by many D-Link routers for remote management and configuration. The vulnerability resides in the /HNAP1/ endpoint on the D-Link DIR-852, where user-supplied input is not properly sanitized before being passed to a system command, a classic command injection weakness (CWE-74). Affected firmware versions are identified by a build date up to 20251002. The underlying issue is improper neutralization of special elements, allowing an attacker to break out of the intended command context.

Affected ProductsAI

D-Link DIR-852 wireless routers with firmware up to the 20251002 build date are affected. The vulnerability is in the /HNAP1/ service endpoint. Full product retirement by the vendor means no further security updates will be provided. Further details are available in the VulDB advisory (ID 327605).

RemediationAI

No vendor patch will be released because the product is end-of-life. Replace or retire the affected router immediately. If replacement is not possible, isolate the device from untrusted networks: disable remote management features, block all access to the HNAP1 endpoint from the WAN (e.g., via firewall rules), and remove the device from any internet-facing exposure. As a workaround, restrict administrative access to trusted internal IPs only. These mitigations will prevent remote exploitation but do not remove the underlying vulnerability from the firmware.