CVE-2025-6897 is a medium (CVSS 5.5) OS command injection in the D-Link DI-7300G+ router, firmware 19.12.25A1. The Time argument of httpd_debug.asp reaches a system command. The record names no fixed firmware, so restrict management access and check D-Link for an update.
What's affected
D-Link DI-7300G+ with firmware version 19.12.25A1, per the record. The affected file is httpd_debug.asp in the device web interface, and the manipulated argument is Time.
The record gives CVSS 3.1 score 5.5, Medium, with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That vector has an adjacent network attack vector and low privileges required, so the score assumes an attacker on the same network segment with a valid low privilege login. The NVD description calls the issue critical, which is the reporting database label, so the description and the score differ. This post uses the score.
The researcher PDF referenced by the record could not be retrieved when I tried (the link returned a not found error), and the record lists no vendor advisory. I could not confirm a fixed firmware version. The record does not flag the issue as exploited in the wild (KEV is false), but it says exploit details were disclosed publicly.
How to check if you're exposed
Check the firmware version in the router administration page, under the system or device information section. Version 19.12.25A1 is the one named in the record.
From a trusted admin machine you can check which addresses reach the management interface. Replace the address with your device:
nmap -p 80,443,8080 192.0.2.1
Review who is on the same network segment as the router's management interface, and whether guest or untrusted devices share it. Router logs may show unexpected admin logins. Do not test the flaw itself against a device you do not own.
What to do now
- Check the D-Link support site for the DI-7300G+ and for any security notice covering this CVE. Install a newer firmware if one is offered, after reading the notes.
- Limit the management interface to a dedicated admin network or specific addresses. Turn off remote management from the internet.
- Change administrator passwords and remove accounts you do not need, since the score assumes a logged in user.
- Keep untrusted devices off the segment that can reach the management page.
- Add the device to your asset inventory with its firmware version so future advisories can be matched quickly.
Why it matters
CWE-77 and CWE-78 describe command injection: text from outside is placed into a command that the device runs, so a crafted value can add commands of its own. On a router, commands run with high privileges, and the router sits between your network and the internet.
The score of 5.5 is held down by the adjacent attack vector and the need for a login. Those are real limits. The risk rises if the management page is reachable from untrusted segments, if accounts share weak passwords, or if the device is internet facing.
Network equipment is easy to forget in vulnerability management because it does not show up in package scans. A short inventory of device models and firmware versions is the starting point, and it is what lets you answer quickly when a record like this appears.
Quick check
Is there a firmware update for CVE-2025-6897?
The record names no fixed firmware and I could not confirm one. Check D-Link support for the DI-7300G+.
Why is the score only medium when the description says critical?
The word critical comes from the reporting database. The CVSS 3.1 vector requires an adjacent network position and a low privilege login, which gives 5.5.
Sources
- Safeguard Gold entry for CVE-2025-6897
- Researcher PDF listed in the record (returned not found when fetched)
- VulDB entry 314389
- D-Link
Last reviewed: 18 October 2026.
