CVE-2025-57636

OS Command injection vulnerability in D-Link C1 2020-02-21. The sub_47F028 function in jhttpd contains a command injection vulnerability via the HTTP parameter "time".

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

1.12% chance of exploitation in the next 30 days, 64th percentile

Published

2025-09-23

Updated

2025-09-24

Proof-of-concept exploits (1)

• glkfc/IoT-Vulnerability/blob/main/D-Link/Dlink_1.md

References

• CVE Record
• NVD entry

Related

• CVE-2026-15480
• CVE-2026-15481
• CVE-2026-2191
• CVE-2026-2192
• CVE-2026-2194
• CVE-2026-4226