D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super user password.
Severity
CVSS 3.1
7.2 high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)