Low severity · published Dec 30, 2025
CVE-2025-15245
D-Link DCS-850L Firmware Update Service uploadfirmware path traversal
3.3
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCS-850L · D-Link
1.02.09 · source: vendor
DF
Dcs-850l Firmware · Dlink
1.02.09 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15245
Exploit
https://tzh00203.notion.site/D-Link-DCS850L-v1-02-09-Path-Traversal-Vulnerability-in-Firmware-Update-2d8b5c52018a803abbc7e30e2858d084?source=copy_link
Permissions Required
https://vuldb.com/?ctiid.338635
Third Party Advisory
https://vuldb.com/?id.338635
Third Party Advisory
https://vuldb.com/?submit.725742
Product
https://www.dlink.com/