CVE-2025-57105 is a command injection vulnerability affecting the DI-7400G+ router. The issue arises in the jhttpd program's handling of the ac_mng_srv_host parameter within the sub_478D28 function in mng_platform.asp and the sub_4A12DC function in wayos_ac_server.asp. This flaw allows unauthenticated remote attackers to execute arbitrary commands on the device, potentially leading to full compromise. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary commands on the affected router, leading to complete compromise of the device. This includes full control over confidentiality, integrity, and availability of the system, which can disrupt network operations and potentially be leveraged for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the router's management interfaces from untrusted networks and monitor for suspicious activity related to the ac_mng_srv_host parameter.