CVE-2025-14225
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.
Risk Assessment
A remote attacker may execute arbitrary commands on the device, potentially leading to full compromise. The exploit has been publicly disclosed and may be utilized.
Recommendation
The product is no longer supported by the maintainer — replace the device with a supported model or isolate it from the network.
Other vulnerabilities in D-Link DCS-930L
See all- CVE-2026-108971Critical
A flaw has been found in D-Link DCS-930L B1.08B4 affecting the mpfd_decode function in bootloader_region.bin of the Emergency HTTP Recovery Server component. Manipulating the firmware argument leads to improper verification of the cryptographic signature. The attack can be performed remotely and the exploit has been published.
- CVE-2016-11021HighActively exploited
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Original NVD description (English source)
A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS