CVE-2025-4858 — Vulnetix

CVE-2025-4858 PUBLISHED CVSS 4.800000190734863 MEDIUM

A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulnerability affects unknown code of the file /adv_arpspoofing.php of the component ARP Spoofing Prevention Page. The manipulation of the argument harp_mac leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.

EPSS 0.24% · 47.7th percentile

Risk Scores

CVSS 4.0

4.800000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.24%

47.7th percentile

Affected Products

Vendor	Product	Versions
D-Link	DAP-2695	*
dlink	dap-2695_firmware	1.20b36r137_all_en_202105286

Exploit Intelligence

CIRCL seen: CVE-2025-4858 (circl-sighting)
CIRCL seen: CVE-2025-4858 (circl-sighting)
VDB-309400 | D-Link DAP-2695 ARP Spoofing Prevention Page adv_arpspoofing.php cross site scripting (circl)
VDB-309400 | CTI Indicators (IOB, IOC, TTP, IOA) (circl)
Submit #575100 | D-Link DAP-2695 firmware 20210528 Cross Site Scripting (circl)
https://www.dlink.com/ (circl)
https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_ARP_Spoofing_Prevention (cve.org)

Timeline

May 18, 2025 EPSS Score
May 18, 2025 CVE Published
May 18, 2025 PoC Published
May 18, 2025 PoC Published
May 22, 2025 CVE Updated
May 29, 2025 EPSS Score
Jun 10, 2025 EPSS Score
Jun 21, 2025 EPSS Score
Jul 2, 2025 EPSS Score
Jul 13, 2025 EPSS Score
Jul 25, 2025 EPSS Score
Aug 5, 2025 EPSS Score

References

Open in Interactive Console →