CVE-2025-10629
Published: 18 September 2025
Summary
CVE-2025-10629 is a low-severity Injection (CWE-74) vulnerability in Dlink Dir-852 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2025-10629 is a command injection vulnerability affecting the D-Link DIR-852 router on firmware version 1.00CN B09. The flaw exists in the ssdpcgi_main function within the htodcs/cgibin file of the Simple Service Discovery Protocol (SSDP) Service component. Manipulation of the ST argument enables arbitrary command execution, as detailed in the CVE description published on 2025-09-18.
The vulnerability allows remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), while maintaining an unchanged impact scope (S:U). Successful exploitation yields low confidentiality, integrity, and availability impacts (C:L/I:L/A:L), scored at CVSS 6.3 under CVSS:3.1 and mapped to CWEs-74 and CWE-77. Attackers with initial low-privilege access can inject commands to further compromise the device.
Advisories from VulDB and a GitHub issue (i-Corner/cve#30) confirm the exploit is publicly disclosed and usable, with no patches available as the product is no longer supported by D-Link. Mitigation involves isolating affected devices from untrusted networks or decommissioning them, per the maintainer's end-of-support status.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29838
Vulnerability details
A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack…
more
may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote command injection vulnerability in the SSDP service (via ST argument in ssdpcgi_main) enables exploitation of a public-facing network service for initial access (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires replacement or approved compensating controls for products that have reached end-of-support and receive no security patches, matching the CVE's unsupported D-Link firmware status.
Enforces boundary protection and network isolation to block remote unauthenticated access to the vulnerable SSDP service from untrusted networks.
Restricts the device to least functionality by disabling or blocking the unnecessary SSDP service that contains the command-injection flaw.