CVE-2018-25120: D-Link DNS-343 Firmware

Critical severity, CVSS 9.8. EPSS: 9.8% chance of exploitation in the next 30 days.

D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.

Affected products

• D-Link DNS-343 Firmware: up to and including 1.0.5

Published 2025-10-29. Last modified 2026-06-17.