CVE-2025-15357: D-Link Di-7400g+ Firmware

Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days.

A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.

Affected products

• D-Link Di-7400g+ Firmware: version 19.12.25a1 only

Published 2025-12-30. Last modified 2026-06-17.