D-Link DIR-860L CVE-2025-14659

The attacker must be able to deliver a DHCP request with an attacker-controlled Hostname option to the device's DHCP daemon - in practice this requires presence on the same LAN/broadcast domain as the DIR-860L B1 or DIR-868L B1 (firmware 203b01/203b03), since DHCP is not routable across the Internet; the 'remote' claim in the source data is therefore constrained to local-network reach despite the AV:N label. No user interaction is required and the injection targets a default-running service (the DHCP daemon), so no non-default configuration is needed. Primary limiting factors: LAN adjacency requirement, the affected models being specific end-of-life hardware revisions, and the likely absence of a vendor patch.

This is a command injection flaw (CWE-74) in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers, exploitable via a crafted Hostname argument. Signals are mixed. The input CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H, score 7.4) indicates a network-reachable attack of low complexity yielding full confidentiality, integrity and availability compromise, with PR:L implying some authentication is required. Publicly available exploit code exists (two Notion write-ups referenced by NVD), and EPSS is 3.80% at the 90th percentile - elevated relative to the average CVE but still a low absolute probability, consistent with a known PoC that is not yet subject to mass automated exploitation. This is NOT in CISA KEV, so there is no confirmed active exploitation. Key caveat on the attack vector: DHCP is intrinsically a local broadcast-domain protocol, so the AV:N 'launched remotely' framing is questionable - realistic exploitation almost certainly requires adjacency to the LAN segment hosting the DHCP service rather than true Internet-wide reach; verify network exposure before treating this as remotely exploitable. The PR:L rating is also debatable, since sending a DHCP request with a crafted hostname typically requires no authentication. Overall: a genuine high-impact (full device takeover) issue on end-of-life consumer hardware, but real-world priority is tempered by LAN-scoped reachability, no confirmed in-the-wild use, and modest EPSS.

An attacker with access to the router's LAN segment (e.g. a rogue or compromised client on the local network) sends a DHCP request containing a malicious Hostname value crafted to break out into a shell command. The vulnerable DHCP daemon processes the hostname without sanitization, executing attacker-supplied OS commands on the router with daemon privileges. Public exploit write-ups demonstrating this against v203b01 and v203b03 firmware are already available online.