D-Link DAP-2695 CVE-2025-11665

Exploitation requires authenticated administrative access to the DAP-2695's management interface (PR:H), because the vulnerable code path is the firmware update handler (fwupdater_main in rgbin), a privileged administrative function. The attack is remote/network-reachable (AV:N) and needs no user interaction (UI:N), but the admin-authentication prerequisite is the primary limiting factor. The affected build is specifically DAP-2695 firmware 2.00RC131; because the product is end-of-life and unsupported, no patched configuration exists, so mitigation depends on restricting management-interface access and rotating/strengthening admin credentials.

Signals are mixed. The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity flaw but explicitly requires high privileges (PR:H), meaning the attacker must already hold administrative access to the DAP-2695 before reaching the fwupdater_main command-injection path - a significant limiting factor that keeps the vendor-assigned score moderate (5.1). Against this, the EPSS score is notably elevated at 6.81% (94th percentile), and a public proof-of-concept exists (IOTRes GitHub writeup), which together indicate above-average attacker interest and a low barrier to weaponization once credentials are obtained. This is NOT in CISA KEV, so there is no confirmation of active exploitation despite the high EPSS percentile - this pattern suggests opportunistic/POC-driven interest rather than confirmed mass exploitation. Net priority is moderate: the PR:H requirement substantially narrows real-world exposure (an unauthenticated attacker cannot directly trigger it), but the combination of a public exploit, a high EPSS percentile, and the fact that the device is end-of-life (no patch will ever ship) means exposed/credential-compromised units should be treated as compromisable and retired or isolated.

An attacker who has obtained administrative credentials to a DAP-2695 access point (via default/weak credentials, reuse, or prior compromise) sends a crafted request to the firmware update handler, injecting shell metacharacters into a parameter processed by fwupdater_main in the rgbin binary. Because a public proof-of-concept exists, the injection payload is readily reproducible, resulting in arbitrary OS command execution on the device. As the product is no longer supported, no vendor fix is available.