# CVE-2025-57105: D-Link DI-7400G+ command injection in jhttpd

Source: https://junglewise.ai/threats/cve-2025-57105-d-link-di-7400g-command-injection-in-jhttpd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-22. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-57105 · Severity: critical · CVSS 9.8 · Published 2025-08-22

The D-Link DI-7400G+ router, a device used for managing enterprise-grade network traffic, contains a critical security flaw. An attacker can remotely take full control of the router by sending specially crafted requests to its management interface. This could lead to a complete network compromise, unauthorized access to internal data, or a total disruption of internet services.

Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2025-57105 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57105 being exploited in the wild.

**How severe is CVE-2025-57105?** Critical severity, with a CVSS score of 9.8, published 22 August 2025.

**Which products and versions are affected?** D-Link DI-7400G+ 19.12.25a1.

**Is there a fix for CVE-2025-57105?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-57105 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-57105?** Check whether you run Dlink Di-7400g\+ or Dlink Di-7400g\+ Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the D-Link DI-7400G+ router within the jhttpd program. The flaw is located in the sub_478D28 function in mng_platform.asp and the sub_4A12DC function in wayos_ac_server.asp. The vulnerability is triggered via the 'ac_mng_srv_host' parameter, which fails to properly neutralize special elements used in OS commands (CWE-77). An unauthenticated remote attacker can exploit this to execute arbitrary commands with the privileges of the web server. Proof-of-concept code has been identified in public repositories.

## Affected products

- D-Link DI-7400G+ 19.12.25a1

## Timeline

- 2025-08-22: disclosed: Initial NVD publication date

## References

- [https://github.com/xyh4ck/iot_poc](https://github.com/xyh4ck/iot_poc)
- [https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B](https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B)
- [https://www.dlink.com/en/security-bulletin/](https://www.dlink.com/en/security-bulletin/)