CVE-2018-25115

D-Link DIR-110/412/600/615/645/815 RCE via service.cgi

Critical10.0EPSS 10.4%

Published: 27 Aug 2025
Updated: 25 May 2026
Reserved: 25 Aug 2025
Assigned by: VulnCheck

Description

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.

Scores

CVSS scores of CVE-2018-25115, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Critical10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Analyzed	4.0	Critical10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 10.4% · top 4.2% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

D-Link · DIR-110
- affected *
D-Link · DIR-412
- affected *
D-Link · DIR-600
- affected *
D-Link · DIR-615
- affected *
D-Link · DIR-645
- affected *
D-Link · DIR-815
- affected 1.03

References (5)

https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce (opens in a new tab)technical-descriptionexploit
https://www.exploit-db.com/exploits/43496 (opens in a new tab)exploit
https://legacy.us.dlink.com/ (opens in a new tab)product
https://support.dlink.com/EndOfLifePolicy.aspx (opens in a new tab)product
https://www.vulncheck.com/advisories/dlink-dir-rce-service-cgi (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25115](https://trackcve.app/badge/CVE-2018-25115.svg)](https://trackcve.app/cve/CVE-2018-25115)

Record last updated 25 May 2026, 23:40 UTC.