CVE-2025-10629
Published: 18 September 2025
Summary
CVE-2025-10629 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dir-852 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote command injection vulnerability in the SSDP service (via ST argument in ssdpcgi_main) enables exploitation of a public-facing network service for initial access (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack…
more
may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2025-10629 is a command injection vulnerability affecting the D-Link DIR-852 router on firmware version 1.00CN B09. The flaw exists in the ssdpcgi_main function within the htodcs/cgibin file of the Simple Service Discovery Protocol (SSDP) Service component. Manipulation of the ST argument enables arbitrary command execution, as detailed in the CVE description published on 2025-09-18.
The vulnerability allows remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), while maintaining an unchanged impact scope (S:U). Successful exploitation yields low confidentiality, integrity, and availability impacts (C:L/I:L/A:L), scored at CVSS 6.3 under CVSS:3.1 and mapped to CWEs-74 and CWE-77. Attackers with initial low-privilege access can inject commands to further compromise the device.
Advisories from VulDB and a GitHub issue (i-Corner/cve#30) confirm the exploit is publicly disclosed and usable, with no patches available as the product is no longer supported by D-Link. Mitigation involves isolating affected devices from untrusted networks or decommissioning them, per the maintainer's end-of-support status.
Details
- CWE(s)