CVE-2025-29165: D-Link DIR-1253 PrivEsc via etc/shadow.sample

An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component by using UART console login.

Zuhri

March 12, 2026 ( 2 min read )

Summary #

D-Link DIR-1253 Prior version <= V1.6.1684 vulnerable to privilege escalation. The file affected at etc/shadow.sample contained a hardcoded root credential. These credentials are used in var/shadow by the following init.d/rcS_{AP,GW} boot script, this script is being execute when booting process is start.

Proof of Concept #

A fully automate Proof of Concept script.

PoC

Details #

The file affected component is located at etc/shadow.sample, this file contained root access level privilege.

root:$1$KEKJV2R0$TFJ4jy7waGKrjdNHwPGzV.:14587:0:99999:7:::
nobody:*:14495:0:99999:7:::

These hardcoded etc/shadow.sample value is used as var/shadow by the following init.d/rcS_AP:30.

#!/bin/sh

//...	

#smbd
mkdir /var/config
mkdir /var/private
mkdir /var/tmp/usb

#for console login
cp /etc/shadow.sample /var/shadow

#extact web pages
cd /web
flash extr /web
cd /

//...

And init.d/rcS_GW:60 init boot script file.

#!/bin/sh

//...

#snmpd
mkdir /var/net-snmp

cp /bin/pppoe.sh /var/ppp/true
echo "#!/bin/sh" > /var/ppp/true
#echo "PASS"     >> /var/ppp/true

#for console login
cp /etc/shadow.sample /var/shadow

#for weave
cp /etc/avahi-daemon.conf /var/avahi

#extact web pages
cd /web
flash extr /web
cd /

//...

Impact #

This vulnerability allows an attacker to compromise root level access via UART console TTY for instance, which will turn into arbitrary attack vector.

Authorized Data Publishers (CISA) #

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline #

# Feb 21, 2025:
+ Vulnerability reported to: D-Link US SIRT.
+ D-Link US SIRT: "We dont recognize this device".

# Aug 07, 2025:
+ Requested CVE ID to MITRE CNA.

# Aug 21, 2025:
+ CVE-2025-29165 was in RESERVED states.

# Mar 03, 2026:
+ CVE-2025-29165 advisory was in public.

# Mar 05, 2026:
+ Requested CVE-2025-29165 states to be PUBLISHED.
+ CVE-2025-29165 advisory was in PUBLISHED states.
+ CVE-2026-29165 was disclosed.

References #

# Links:
+ https://codeberg.org/zuhri/advisory/src/branch/main/CVE-2025-29165
+ https://www.cve.org/CVERecord?id=CVE-2025-29165
+ https://nvd.nist.gov/vuln/detail/CVE-2024-37630
+ https://cwe.mitre.org/data/definitions/276.html
+ https://cwe.mitre.org/data/definitions/798.html
+ https://cwe.mitre.org/data/definitions/269.html

# Firmware:
+ https://codeberg.org/zuhri/advisory/raw/branch/main/CVE-2025-29165/DLINK_N2M_ID_V1.6.1684.bin
+ https://github.com/zxhri/DIR-1253
+ https://archive.org/details/dir-1253-m-dlink-id-v-1.6.1527

CVE-2026-52533: D-Link DIR-1253 White PrivEsc via etc/shadow

→

↑ back to top ↑