CVE-2025-9769

CVE-2025-9769 is a command injection flaw in the sub_478D28 function of the management page /mng_platform.asp on D-Link DI-7400G+ routers. It is triggered by manipulating the 'addr' argument of that page (demonstrated with input like 'echo 12345 > poc.txt'), which lets injected commands be run on the device. Per the CVSS 4.0 vector, the attack requires physical access to the device and low privileges, and the impact on confidentiality, integrity, and availability is rated low, yielding an overall severity of 0.9 (low). Only D-Link DI-7400G+ firmware version 19.12.25A1 is identified as affected in the current data. Exploitation status: a public proof-of-concept exists (2 references), the flaw is not yet in CISA KEV, and EPSS assigns a 25.9% probability of exploitation within 30 days (98th percentile).

What to do: Check whether your DI-7400G+ runs firmware 19.12.25A1 and monitor D-Link advisories for a patched release, since no fixed version is listed in the current data. Because exploitation requires physical access, physically secure the device and restrict access to the management interface and the /mng_platform.asp 'addr' parameter to trusted users. Given the elevated EPSS score (25.9% in 30 days), prioritize verification even though the flaw is rated low severity.