CVE-2025-6896mediumCWE-77CWE-78

CVE-2025-6896: medium-severity vulnerability in D-Link DI-7300G+

D-Link DI-7300G+ wget_test.asp os command injection

Published

Follow this CVE+ Monitor DI-7300G+

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 4.4%
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
D-Link · DI-7300G+
Related CVEs — D-Link DI-7300G+

In the same product, most dangerous first.

CVE-2025-6898MEDIUMD-Link DI-7300G+ in proxy_client.asp os command injectionEPSS 17.5%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.8%CVE-2025-6897MEDIUMD-Link DI-7300G+ httpd_debug.asp os command injectionEPSS 2.3%