CVE-2025-14225

MediumCVSS 6.3

Published: 08/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

8.86%

95th percentile - higher than 95% of all known CVEs

Summary

A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.

Risk Assessment

A remote attacker may execute arbitrary commands on the device, potentially leading to full compromise. The exploit has been publicly disclosed and may be utilized.

Recommendation

The product is no longer supported by the maintainer — replace the device with a supported model or isolate it from the network.

Other vulnerabilities in D-Link DCS-930L

CVE-2016-11021HighActively exploited
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

Original NVD description (English source)

A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS