CVE-2018-25120 – D-Link DNS-343 ShareCenter

CVE ID : CVE-2018-25120

Published : Oct. 29, 2025, 6:39 p.m. | 45 minutes ago

Description : D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint ‘/goform/Mail_Test’ and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.

Severity: 9.3 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…