D-Link mng_platform.asp addr Parameter Command Injection Attempt (CVE-2025-57105)

Tim Peck@timpeck

•updated Nov 10, 2025•0•16

This rule detects attempts to exploit a command injection vulnerability (CVE-2025-57105) in D-Link devices. Specifically, it looks for HTTP GET requests to '/mng_platform.asp' where the 'addr' parameter contains characters commonly used for command injection, such as semicolons, newlines, backticks, pipes, or dollar signs, which could lead to arbitrary command execution on the device.