Analysis Summary

CVE-2025-7194 CVSS:8.8

A vulnerability was found in D-Link DI-500WF 17.04.10A1T. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file ip_position.asp of the component jhttpd. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7192 CVSS:6.3

A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Impact

• Gain Access
• Buffer Overflow

Indicators of Compromise

CVE

• CVE-2025-7194

• CVE-2025-7192

Affected Vendors

Remediation

Refer to D-Link Website for patch, upgrade, or suggested workaround information.

D-Link Website