CVE-2025-12296
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Risk Assessment
Remote command injection can allow an attacker to gain full control of the device, potentially leading to network traffic interception or use of the device for further attacks.
Recommendation
Due to lack of vendor support, it is recommended to decommission the device and replace it with a newer model. Restrict remote access to the device.
Other vulnerabilities in D-Link DAP-2695
See all- CVE-2025-11665Medium
A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2025-12295Medium
A weakness has been identified in D-Link DAP-2695 2.00RC13, affecting the function sub_40C6B8 of the Firmware Update Handler component. Manipulation can lead to improper verification of cryptographic signature. The attack can be launched remotely but is highly complex and difficult to exploit.
Original NVD description (English source)
A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS