Is there a public PoC exploit available for CVE-2025-15357?

Yes, a public proof-of-concept exploit is available for CVE-2025-15357. Prioritise patching immediately. EPSS: 0.1%.

D-Link DI-7400G+ CVE-2025-15357

Q: What is the CVSS score of CVE-2025-15357?

CVE-2025-15357 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-30 cna@vuldb.com

Command Injection D-Link Di 7400G Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Command injection on embedded routers typically yields root OS execution (S:C, C/I/A:H); PR:L per provided CVSS 4.0 vector indicating authentication required.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:37 vuln.today

CVE Published

Dec 30, 2025 - 21:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the cmd parameter of the /msp_info.htm?flag=cmd web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.

Technical ContextAI

The D-Link DI-7400G+ is a business-class router running embedded Linux firmware. The affected endpoint /msp_info.htm?flag=cmd is part of the device's web management interface. The cmd GET/POST parameter is passed unsanitized to an underlying shell command execution function, constituting a CWE-74 (Injection) / OS command injection flaw. CPE confirms the exact affected artifact: cpe:2.3:o:dlink:di-7400g+_firmware:19.12.25a1:*:*:*:*:*:*:*. Successful injection likely yields command execution under the context of the web server process, which on embedded routers frequently runs as root, enabling full device takeover. The vulnerability class is classic parameter injection with no apparent sanitization or allowlisting of the cmd value.

RemediationAI

No vendor-released patch has been independently confirmed at the time of analysis - the D-Link site is referenced but no specific security advisory or patched firmware version number appears in the available intelligence. As an immediate compensating control, administrators should restrict access to the web management interface by disabling remote (WAN-side) management and limiting LAN-side access to trusted management hosts via ACL or VLAN segmentation, which eliminates the network attack vector but does not remove the underlying flaw. Additionally, changing all default management credentials to strong, unique passwords reduces the exploitable attack surface since PR:L authentication is required. Monitoring for anomalous HTTP requests to /msp_info.htm with unusual cmd parameter values can provide detection coverage. Check https://www.dlink.com/ and VulDB entry https://vuldb.com/?id.338743 for firmware updates as they become available.