Command Injection Vulnerability in D-Link DIR895LA1 Router
CVE-2025-69542

9.8CRITICAL

Key Information:

Vendor

D-Link
Status
DIR895LA1
Vendor
CVE Published:
9 January 2026

What is CVE-2025-69542?

A command injection vulnerability has been identified in the DHCP daemon service of the D-Link DIR895LA1 router, specifically in version v102b07. This issue arises during the lease renewal process, where the DHCP hostname parameter is improperly sanitized and directly concatenated into a system command. If a malicious client sends a renewal request with a crafted hostname, it can lead to the execution of arbitrary commands with root privileges, posing a significant risk to network security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://tzh00203.notion.site/D-Link-DIR895LA1-v102b07-Com...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.