CVE-2025-29165

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-29165", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-09T16:12:22.216Z", "dateReserved": "2025-03-11T00:00:00.000Z", "datePublished": "2026-03-05T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-20T18:15:58.925Z"}, "descriptions": [{"lang": "en", "value": "An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.dlink.com/en/security-bulletin/"}, {"url": "https://github.com/twentysevns/Vuln-IoT-Reports/blob/main/DLINK/DIR-1253/README.md"}, {"url": "https://codeberg.org/zuhri/advisory/src/branch/main/CVE-2025-29165"}, {"url": "https://zuh.re/cve/2025-29165/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T10:02:57.329963Z", "id": "CVE-2025-29165", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T16:12:22.216Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-29165", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T10:02:57.329963Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T10:05:34.031Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.dlink.com/en/security-bulletin/"}, {"url": "https://github.com/twentysevns/Vuln-IoT-Reports/blob/main/DLINK/DIR-1253/README.md"}, {"url": "https://codeberg.org/zuhri/advisory/src/branch/main/CVE-2025-29165"}, {"url": "https://zuh.re/cve/2025-29165/"}], "descriptions": [{"lang": "en", "value": "An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-20T18:15:58.925Z"}}}, "cveMetadata": {"cveId": "CVE-2025-29165", "state": "PUBLISHED", "dateUpdated": "2026-04-09T16:12:22.216Z", "dateReserved": "2025-03-11T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-05T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-1253_firmware:1.6.1684:*:*:*:*:*:*:*", "matchCriteriaId": "A544103F-F48F-4339-89A5-9AE0EE0828A5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-1253:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D27B8DA-CF1E-424F-825D-A6EEB301A722", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component"}, {"lang": "es", "value": "Un problema en D-Link DIR-1253 MESH V1.6.1684 permite a un atacante escalar privilegios a trav\u00e9s del componente etc/shadow.sample"}], "id": "CVE-2025-29165", "lastModified": "2026-06-17T09:05:10.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-29165", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T10:02:57.329963Z", "version": "2.0.3"}}]}, "published": "2026-03-05T20:16:10.920", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://codeberg.org/zuhri/advisory/src/branch/main/CVE-2025-29165"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://github.com/twentysevns/Vuln-IoT-Reports/blob/main/DLINK/DIR-1253/README.md"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.dlink.com/en/security-bulletin/"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://zuh.re/cve/2025-29165/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.6.1684"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "dir-1253", "vendor": "dlink"}], "analysis": {"en": {"generated_at": "2026-04-20T20:48:08.520192+00:00", "value": {"mitigation_remediation": ["Update the router firmware to the latest version released by D\u2011Link, which addresses the privilege\u2011escalation flaw.", "If a firmware update is not immediately available, force a factory reset to clear any compromised configuration and block all unused management ports.", "Configure the router\u2019s access control list to restrict management access to trusted IP ranges and enforce strong authentication, mitigating potential misuse of the affected component."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue affects D\u2011Link DIR\u20111253 MESH devices running firmware version 1.6.1684. No other vendor or product variants are listed; the vulnerability appears specific to this model and firmware build.", "description_and_impact": "An attacker can exploit a flaw in the etc/shadow.sample component of the D-Link DIR-1253 MESH firmware to gain elevated privileges within the device. The vulnerability permits escalation of authority from a lower\u2011privileged user context to full system control, allowing the attacker to alter configuration, install persistent malware, or disable security controls. The weakness maps to CWE\u2011269, indicating that the system fails to enforce proper privilege boundaries.", "risk_and_exploitability": "EPSS score < 1% indicates a very low probability of exploitation. The CVSS score of 9.8 indicates a critical severity. The reported vulnerability could allow full control over the router, compromising network security and enabling further attacks against connected devices."}}}}, "created": "2026-03-06T15:18:17.533160+00:00", "title": "Privilege Escalation via /etc/shadow.sample on D-Link DIR-1253", "updated": "2026-04-20T21:00:12.913090+00:00", "vendors": ["dlink", "dlink$PRODUCT$dir-1253"]}