Which versions of Dcs 930l Firmware are affected by CVE-2025-14225?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-14225, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-14225?

Yes, a public proof-of-concept exploit is available for CVE-2025-14225. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-14225?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Dcs 930l Firmware CVE-2025-14225

Q: What is the CVSS score of CVE-2025-14225?

CVE-2025-14225 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-201702 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-08 cna@vuldb.com

Command Injection D-Link Dcs 930l Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201702

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

PoC Detected

Dec 11, 2025 - 00:07 vuln.today

Public exploit code

CVE Published

Dec 08, 2025 - 10:15 nvd

MEDIUM 6.3

CVE Published

Dec 08, 2025 - 10:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Remote command injection in D-Link DCS-930L firmware version 1.15.04 allows authenticated attackers to execute arbitrary system commands via the AdminID parameter of the /setSystemAdmin endpoint. Exploit code is publicly available, but the device is end-of-life and unsupported, so no official patch is expected. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.