CVE-2025-4341
Published: 06 May 2025
Summary
CVE-2025-4341 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dir-880L Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-4341 is a command injection vulnerability in the Request Header Handler component of the D-Link DIR-880L router, specifically within the sub_16570 function of the /htdocs/ssdpcgi file. It affects firmware versions up to 104WWb01 and arises from unsafe handling of the HTTP_ST, REMOTE_ADDR, REMOTE_PORT, and SERVER_ID arguments, classified under CWE-74 and CWE-77. The issue is rated 5.3 under CVSS 4.0 and impacts only devices that are no longer supported by the vendor.
An authenticated remote attacker can supply crafted values in these arguments to inject and execute arbitrary commands on the device. Public exploit code has been released, enabling straightforward remote exploitation without user interaction.
References including the D-Link site and Vuldb entries note that the affected hardware is end-of-life, with no patches or official mitigations provided. Network segmentation and removal of exposed devices from service are the primary defensive options.
The associated EPSS score has remained flat at a low 0.0135 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13524
Vulnerability details
A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdocs/ssdpcgi of the component Request Header Handler. The manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command…
more
injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.