CVE-2018-25115 is a critical (CVSS 9.8) command injection in the service.cgi endpoint of D-Link DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645 and DIR-815 routers at firmware 1.03. The EVENT=CHECKFW value reaches the shell, so commands run as root. The record says the models are no longer supported.
What's affected
According to the record: D-Link DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645 and DIR-815 routers at firmware version 1.03. The record adds that these models were no longer supported when it was published.
The flaw is in the service.cgi endpoint. A parameter named EVENT with the value CHECKFW is passed directly to the system shell without sanitization, and a crafted POST request runs commands as root, giving full device compromise.
I could not confirm a fixed firmware. D-Link's end of life policy page, which the record links, explains that products at the end of support no longer receive updates. For an unsupported model, no fix should be expected.
The device list in the record is wide: seven model names that share the same firmware lineage. That is typical for consumer router families, where one code base ships under several model numbers. When you build your inventory, search by firmware version as well as by model name, because relabelled or regional variants can carry the same service.cgi code.
How to check if you're exposed
Identify the model, hardware revision and firmware of each router. The status page in the admin interface shows the firmware version. Firmware 1.03 on any of the listed models is in scope.
Check exposure from outside your network, against addresses you own:
nmap -p 80,8080,23 <router-wan-address>
An open web interface means remote management is on. An unexpected open Telnet port can be a sign of compromise.
Then check the model's support status on the D-Link support site. The record says these models were unsupported when it was written.
If you manage many sites, ask each office for a photo or a screenshot of the router's status page rather than relying on purchase records. Firmware version and model are both shown there, and the exercise often turns up spare or forgotten units.
What to do now
- Build a list of D-Link routers, with model, revision and firmware, across your sites and remote workers.
- Plan to replace any listed model that is out of support. A router that cannot be patched cannot be defended.
- Until it is replaced, turn off remote management and place it behind another firewall.
- If you suspect tampering, factory reset the device and reconfigure it from scratch, then change the admin password.
- Add device support dates to your asset inventory so replacements are scheduled, not reactive.
Why it matters
The class is CWE-78 (OS Command Injection). Routers often run a small web server whose handlers call shell commands. If a handler builds a command from a request value, special characters in that value can run extra commands. A firmware check is a typical place for this: it feels internal, so the input does not get validated.
The bigger story is the lifecycle. The record says these models are no longer supported. That means the vulnerability will not be fixed, and it will stay in every unit still on the network. The control that works is not patching. It is retiring the hardware.
Router fleets are easy to forget. Home office routers used by staff, branch office gear and old spares in cupboards all count. A simple inventory with end of support dates turns this from a surprise into a routine replacement.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public proof of concept material is referenced.
Quick check
Will D-Link release a patch?
The record says the models were no longer supported when it was published. Plan on replacement, and check the end of life policy for your model.
Which firmware is affected?
The record names version 1.03 across the listed models.
Sources
Last reviewed: 19 October 2026.
