CVE-2020-25757

🗓️ 15 Dec 2020 20:15:16Reported by [email protected]Type

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	DSR-150 Router Input Validation	19 Jan 202100:00	–	bdu_fstec
Circl	CVE-2020-25757	10 Dec 202013:07	–	circl
CNNVD	Multiple D-Link Router Products Input Validation Error Vulnerability	15 Dec 202000:00	–	cnnvd
CVE	CVE-2020-25757	15 Dec 202019:27	–	cve
Cvelist	CVE-2020-25757	15 Dec 202019:27	–	cvelist
EUVD	EUVD-2020-18408	7 Oct 202500:30	–	euvd
osv_cve	CVE-2020-25757	15 Dec 202020:15	–	osv_cve
Prion	Input validation	15 Dec 202020:15	–	prion
Positive Technologies	PT-2020-5337	11 Aug 202000:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2020-25757: Improper Input Validation	15 Dec 202000:00	–	rapid7

NVD

Node

AND

dlink dsr-150_firmwareRange≤3.17

dlink dsr-150Match-

Node

AND

dlink dsr-150n_firmwareRange≤3.17

dlink dsr-150nMatch-

Node

AND

dlink dsr-250_firmwareRange≤3.17

dlink dsr-250Match-

Node

AND

dlink dsr-250n_firmwareRange≤3.17

dlink dsr-250nMatch-

Node

AND

dlink dsr-500_firmwareRange≤3.17

dlink dsr-500Match-

Node

AND

dlink dsr-500n_firmware

dlink dsr-500nMatch-

Node

AND

dlink dsr-500ac_firmwareRange≤3.17

dlink dsr-500acMatch-

Node

AND

dlink dsr-1000_firmwareRange≤3.17

dlink dsr-1000Match-

Node

AND

dlink dsr-1000n_firmwareRange≤3.17

dlink dsr-1000nMatch-

Node

AND

dlink dsr-1000ac_firmwareRange≤3.17

dlink dsr-1000acMatch-

Source	Link
dlink	www.dlink.com/en/security-bulletin
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
digitaldefense	www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/

17 Jun 2026 03:07Current

8.9High risk

Vulners AI Score8.9

CVSS 28.3

CVSS 3.18.8

EPSS0.02133