Vulnerability record · CVE-2025-14225 · published 8 December 2025

CVE-2025-14225: Dlink dcs-930l firmware injection vulnerability

Dlink · Dcs 930l Firmware

A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

2.1 CVSS 4.0 Low EPSS 8.9% · top 5.0% CWE-74 · InjectionCWE-77 · Command injection

2.1CVSS 4.0 base score, v2 6.5

8.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Dcs 930l Firmware Dlink

References

Link	Tags
https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-1/D-Link%20Vulnerability.md	ExploitThird Party Advisory
https://vuldb.com/?ctiid.334667	Permissions RequiredVDB Entry
https://vuldb.com/?id.334667	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.701774	Third Party AdvisoryVDB Entry
https://www.dlink.com/	Product

Track CVE-2025-14225 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.2CVE-2016-11021D-Link DCS-930L camera OS command injection via SystemCommand parameterD-Link DCS-930L devices before firmware 2.12 pass the SystemCommand parameter to setSystemCommand without sanitizing it, allowing OS command injectio…KEVEPSS 69%analysed9 Mar 2020 8.8CVE-2019-10999Dlink dcs-930l firmware out-of-bounds write vulnerabilityThe D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely aut…EPSS 3.6%6 May 2019 8.8CVE-2017-7852Dlink dcs-2230l firmware cross-site request forgery vulnerabilityD-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's s…EPSS 4.3%24 Apr 2017 7.5CVE-2018-18441D-link dcs-936l firmware information exposure vulnerabilityD-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, suc…EPSS 1.9%20 Dec 2018 10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed16 Jul 2025 10.0CVE-2025-20281Cisco ISE API unauthenticated remote code executionCisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, allowing a crafted request to reach the underlying operating s…KEVEPSS 98%analysed25 Jun 2025 7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed3 Apr 2023 9.8CVE-2023-22527Atlassian Confluence Data Center and Server template injection RCEOlder versions of Confluence Data Center and Server contain a template injection flaw (CWE-74) that lets an unauthenticated attacker execute code on …KEVEPSS 100%analysed16 Jan 2024

Source: NIST National Vulnerability Database (record CVE-2025-14225), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.