Command Injection in lighttpd Cookie Handling on D-Link DSP-W110A1 (v1.05B01)
CVE-2025-34125 Published on July 16, 2025
D-Link DSP-W110A1 Cookie Command Injection
An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the underlying Linux operating system. Successful exploitation enables full system compromise.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2025-34125 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2025-34125
Want to know whenever a new CVE is published for D-Link Dsp W215 Firmware? stack.watch will email you.
Affected Versions
D-Link DSP-W110A1 Version 1.05B01 is affected by CVE-2025-34125Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.