Overview
CVE-2025-57105 is a serious security vulnerability found in DI-7400G+ routers that allows malicious users to execute arbitrary commands on the device. This vulnerability could lead to a total system compromise or data leakage, putting the integrity and confidentiality of data at risk. As routers are critical network infrastructure devices, the security of these devices is paramount to maintaining secure network operations. The exploit has the potential to impact any individual or entity that utilizes a DI-7400G+ router, making it a high priority concern for cybersecurity professionals.
Vulnerability Summary
CVE ID: CVE-2025-57105
Severity: Critical (9.8 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
DI-7400G+ Router | All versions prior to patch
How the Exploit Works
The vulnerability exists due to insufficient sanitization of user-supplied inputs in the “ac_mng_srv_host” parameter within the sub_478D28 function in mng_platform.asp and the sub_4A12DC function in wayos_ac_server.asp of the jhttpd program. This allows attackers to inject malicious commands that the system executes, granting them unauthorized access and control over the compromised device.
Conceptual Example Code
Below is a conceptual example of a malicious HTTP request that an attacker might use to exploit this vulnerability:
POST /mng_platform.asp HTTP/1.1
Host: <Target Router IP>
Content-Type: application/x-www-form-urlencoded
ac_mng_srv_host=; <malicious command> #By inserting a semicolon (;) followed by a space, an attacker can effectively terminate the current command and start a new one. The hash (#) at the end serves as a comment, ensuring that anything following it is ignored, thus preventing any potential errors that could arise from trailing characters.
Mitigation and Prevention
To mitigate this vulnerability, users are advised to apply the vendor patch as soon as it is available. Until then, a WAF (Web Application Firewall) or IDS (Intrusion Detection System) can be used as a temporary mitigation strategy to detect and block attempts to exploit this vulnerability. It’s also recommended to restrict network access to the router’s management interface to trusted IPs only and always use secure and complex passwords to further enhance the security of the system.