← Vulnerability feed

Vulnerability record · CVE-2025-4860 · published 18 May 2025

CVE-2025-4860: Dlink dap-2695 firmware cross-site scripting vulnerability

Dlink · Dap 2695 Firmware

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps.php of the component Static Pool Settings Page. The manipulation of the argument f_mac leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.

4.8 CVSS 4.0 Medium EPSS 0.81% · top 45.0% CWE-79 · Cross-site scriptingCWE-94 · Code injection
4.8CVSS 4.0 base score, v2 3.3
0.81%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps.php of the component Static Pool Settings Page. The manipulation of the argument f_mac leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_Static_Pool_Settings ExploitThird Party Advisory
https://vuldb.com/?ctiid.309402 Permissions RequiredVDB Entry
https://vuldb.com/?id.309402 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.575103 Third Party AdvisoryVDB Entry
https://www.dlink.com/ Product
https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_Static_Pool_Settings ExploitThird Party Advisory

Track CVE-2025-4860 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-1558Dlink dap-3662 firmware memory buffer overflow vulnerabilityBuffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP…EPSS 9.1%7.5CVE-2022-38873Dlink dap-2310 firmware insufficient verification of data authenticity vulnerabilityD-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DA…EPSS 0.48%7.5CVE-2021-28838Dlink dap-2310 firmware null pointer dereference vulnerabilityNull pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1…EPSS 2.2%7.5CVE-2021-28839Dlink dap-2310 firmware null pointer dereference vulnerabilityNull Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 …EPSS 1.4%7.5CVE-2021-28840Dlink dap-2310 firmware null pointer dereference vulnerabilityNull Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 …EPSS 2.3%6.6CVE-2025-12295Dlink dap-2695 firmware insufficient verification of data authenticity vulnerabilityA weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler.…EPSS 0.41%5.1CVE-2025-11665Dlink dap-2695 firmware command injection vulnerabilityA vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Updat…EPSS 6.8%4.8CVE-2025-4859Dlink dap-2695 firmware cross-site scripting vulnerabilityA vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing…EPSS 0.94%

Source: NIST National Vulnerability Database (record CVE-2025-4860), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.