{"id":"CVE-2018-25120","published":"2025-10-29T18:39:03Z","modified":"2026-05-14T02:06:31Z","title":"D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test","vendor":"D-Link","product":"DNS-343 ShareCenter","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-Link","product":"DNS-343 ShareCenter","versions":["<= 1.05"]}],"description":{"text":"D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.","provenance":"source","from":"CVE.org"},"summary":{"text":"The D-Link DNS-343 ShareCenter, up to and including firmware 1.05, contains a command injection flaw in its Mail Test functionality, where form parameters posted to the internal /goform/Mail_Test endpoint are passed unvalidated into a system email utility. An unauthenticated remote attacker with network access to the device can submit crafted form data to inject shell commands and execute them as root, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:24Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.09806,"percentile":0.95534,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-29","exploitedFirstSeen":"2025-10-29","ransomware":false,"evidence":[{"url":"https://www.vulncheck.com/advisories/dlink-dns343-sharecenter-command-injection-via-goform-mail-test","date":"2025-10-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-24&host_type=src&vulnerability=cve-2018-25120","date":"2026-02-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-25&host_type=src&vulnerability=cve-2018-25120","date":"2026-02-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-26&host_type=src&vulnerability=cve-2018-25120","date":"2026-02-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-28&host_type=src&vulnerability=cve-2018-25120","date":"2026-02-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-05&host_type=src&vulnerability=cve-2018-25120","date":"2026-03-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-06&host_type=src&vulnerability=cve-2018-25120","date":"2026-03-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-08&host_type=src&vulnerability=cve-2018-25120","date":"2026-03-08"},{"url":"https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis","date":"2026-03-11"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.exploit-db.com/exploits/43845","tags":["exploit"]},{"url":"https://qkl.seebug.org/vuldb/ssvid-97088","tags":["exploit"]},{"url":"https://www.dlink.com/al/sq/products/dns-343-sharecenter-4-bay-network-storage-enclosure","tags":["product"]},{"url":"https://github.com/jamesbercegay/advisories/blob/master/%5BGTSA-00128%5D%20D-Link%20DNS-343%20ShareCenter%201.05%20Remote%20Root.txt","tags":["technical-description","exploit"]},{"url":"https://www.vulncheck.com/advisories/dlink-dns343-sharecenter-command-injection-via-goform-mail-test","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-21606","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21606","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.exploit-db.com/exploits/43845","https://qkl.seebug.org/vuldb/ssvid-97088","https://github.com/jamesbercegay/advisories/blob/master/%5BGTSA-00128%5D%20D-Link%20DNS-343%20ShareCenter%201.05%20Remote%20Root.txt"],"flow":[],"timeline":[{"date":"2025-10-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-25120","provenance":"source"},{"date":"2025-10-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.vulncheck.com/advisories/dlink-dns343-sharecenter-command-injection-via-goform-mail-test","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 366 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.11,"detail":"percentile 0.9553"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}