Dcs 850L Firmware CVE-2025-15245

We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields.

First, gather data:

• CVE ID: CVE-2025-15245
• Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported.
• CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit.
• EPSS: 0.09% (25th percentile), low
• KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation.
• CWE-22: Path traversal.
• Tags: D-Link, Path Traversal, Dcs 850L Firmware
• References: nvd links include exploit writeup, vuldb, dlink homepage.
• CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09.
• CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement.
• The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls.

Now, we need to write each field as a plain text string, a coherent paragraph.

product_name: just the product. "D-Link DCS-850L" is good.

summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild."

technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09."

risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks."

affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/."

remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references.

exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available."

exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default.

attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain.

confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise."

prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low".

prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint"

assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that.

assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N."

assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that.

Now compile all into JSON. Ensure no arrays, only strings.

Check each field:

• product_name: "D-Link DCS-850L"
• summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good.
• technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09."
• risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good.
• affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/."
• remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with