Description
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Published: 2025-12-29
Score: 5.3 Medium
EPSS: 4.1% Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 30 Dec 2025 21:45:00 +0100

Type Values Removed Values Added
First Time appeared Dlink
Dlink dwr-m920
Dlink dwr-m920 Firmware
CPEs cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m920_firmware:*:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dwr-m920
Dlink dwr-m920 Firmware

Tue, 30 Dec 2025 00:15:00 +0100

Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m920
Vendors & Products D-link
D-link dwr-m920

Mon, 29 Dec 2025 17:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Dec 2025 15:45:00 +0100

Type Values Removed Values Added
Description A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Title D-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dwr-m920
Dlink Dwr-m920 Dwr-m920 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-12-29T16:11:38.000Z

Reserved: 2025-12-28T09:10:12.267Z

Link: CVE-2025-15192

cve-icon Vulnrichment

Updated: 2025-12-29T16:11:32.392Z

cve-icon NVD

Status : Analyzed

Published: 2025-12-29T15:16:00.377

Modified: 2026-10-07T12:10:00.170

Link: CVE-2025-15192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-30T00:03:44Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')