CVE-2025-14659 is a high severity command injection (CVSS 8.8) in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers, firmware 203b01 and 203b03. The record lists no fixed firmware. Check D-Link's support pages for a patch and limit management and network access in the meantime.
What's affected
The record names two hardware revisions and the firmware builds it tested:
- D-Link DIR-860L B1, firmware 203b03.
- D-Link DIR-868L B1, firmware 203b01.
The weakness is in the DHCP Daemon component, and the argument involved is the Hostname value. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, low privileges required, no user interaction, with high impact on confidentiality, integrity and availability.
The record does not list a fixed firmware version. It says an exploit has been made public. It is not in the CISA KEV catalog, and nothing in the record says it has been used in attacks.
Two public write ups on Notion are linked from the record, one per model. This post does not reproduce their technical details.
How to check if you're exposed
Your router's admin page shows the model, hardware revision and firmware version, usually on a status or tools page. Compare them with the list above.
If you manage many sites, ask for an inventory export from whatever tool tracks your network gear. A spreadsheet of model, revision and firmware is enough to answer this question quickly.
The record does not describe a vendor check or detection method. Look at the D-Link security advisory page for these models for the vendor's own guidance, and treat that page as the authority on fixed firmware.
What to do now
- List every DIR-860L and DIR-868L unit you own or support, with hardware revision and firmware build.
- Check D-Link's support and security pages for a firmware update. The record names none, so confirm before you assume one exists.
- If an update exists, schedule it and keep a copy of your router configuration first.
- Turn off remote management from the internet, and restrict the admin interface to a trusted network.
- Segment the router from sensitive systems so that a compromised device has little to reach.
- If no fix is offered, plan to replace the devices. Make that call with the vendor's support status in hand rather than from this post.
Why it matters
The class is CWE-77, command injection, within CWE-74, injection into a downstream component. A DHCP daemon reads values supplied by other devices on the network, such as a host name. If that value is passed into a shell command without being cleaned, it can be read as part of the command rather than as plain data.
That is why the impact scores are all high. A router sits between your network and the internet and sees all traffic that crosses it. Whoever runs commands on it has a strong foothold. The low privilege requirement in the vector tempers the risk a little, but home and small office routers are often left with default or shared credentials.
Routers are also hard to patch. Firmware updates are manual, many units are never updated, and nobody tracks them in a software inventory. Treat this as an asset question first and a patching question second.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a firmware fix for CVE-2025-14659?
The CVE record does not list a fixed version. Check D-Link's support and security pages for DIR-860L B1 and DIR-868L B1, and take the vendor's guidance over any third party summary.
Does this affect every D-Link router?
No. The record names the DIR-860L B1 and DIR-868L B1 only, on the firmware builds listed. Other models may have their own advisories.
Sources
Last reviewed: 19 October 2026.
