CVE-2025-55583

Critical

Description

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

SeverityCritical

CVSS9.8

Exploit probability—

ProductDlink Dir-868l Firmware

PublishedAug 28, 2025

First seenAug 28, 2025

Weakness typeCWE-78OS command injection CWE-306Missing authentication for critical function CWE-668CWE-668

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
dlink dir-868l_firmware	2.05b02	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.