CVE-2025-60854

{
  "id": "CVE-2025-60854",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-02T18:15:48.600",
  "lastModified": "2026-11-04T23:10:00.223",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en D-Link R15 (AX1500) 1.20.01 y versiones inferiores. Al manipular el parámetro del nombre del modelo durante una solicitud de cambio de contraseña en la página de administración web, es posible desencadenar una inyección de comandos en httpd."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-03T15:06:51.071165Z",
          "id": "CVE-2025-60854",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dlink:r15_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.20.01",
              "matchCriteriaId": "2A536AEC-E3A7-4085-B979-18D8B1A1A6BA"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:dlink:r15:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "714513B8-0676-46AF-82B2-4076F75BA17A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10473",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}