{"cvss":9.8,"datePublished":"2026-08-13T00:00:00Z","dateUpdated":"2026-08-13T00:00:00Z","description":"D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.","dueDate":"","id":"CVE-2025-55583","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"dir-868l_firmware","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"D-Link dir-868l_firmware Improper Neutralization of Special Elements used in an OS Command","vendor":"D-Link"}