This vulnerability (CVE-2025-34125) affects the D-Link DSP-W110A1 device running firmware version 1.05B01. It arises from improper neutralization of special elements in the cookie handling process of the embedded lighttpd web server, classified as CWE-78 (OS Command Injection). Because the vulnerability is unauthenticated and remotely exploitable over the network, an attacker can inject OS commands via crafted cookie values, resulting in arbitrary command execution on the device's Linux operating system. This can lead to full system compromise. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands without authentication, leading to full compromise of the affected device. This includes potential control over device functionality, data, and network operations. The critical CVSS score (9.3) reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity. Avoid exposing the device's web interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.