CVE-2025-7192
Published: 08 July 2025
Summary
CVE-2025-7192 is a low-severity Injection (CWE-74) vulnerability in Dlink Dir-645 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).
Deeper analysis
A vulnerability classified as critical exists in D-Link DIR-645 routers up to firmware version 1.05B01. It resides in the ssdpcgi_main function within the /htdocs/cgibin file of the ssdpcgi component and stems from improper handling of input that permits command injection, corresponding to CWE-74 and CWE-77. The flaw is remotely triggerable and affects devices that are no longer supported by the vendor.
An authenticated remote attacker can supply crafted input to the affected function to execute arbitrary commands on the device. Publicly disclosed exploit code demonstrates that successful exploitation yields limited control over the system, consistent with the CVSS 2.1 rating that reflects low impact across confidentiality, integrity, and availability.
The EPSS score remains flat at 0.0207 with no material increase after disclosure. References indicate the issue was reported through public channels including a detailed GitHub proof-of-concept, but no vendor patches or mitigation guidance are available because the product line is unsupported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20690
Vulnerability details
A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely.…
more
The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection in the router's public-facing ssdpcgi CGI enables exploitation of public-facing applications (T1190), network device CLI command execution (T1059.008), and indirect command execution (T1202) as explicitly noted in advisories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires replacement or approved compensating controls for unsupported system components such as the end-of-life D-Link DIR-645 with no patches available.
Boundary protection (firewalls, segmentation, ACLs) blocks unauthenticated remote access to the vulnerable ssdpcgi CGI endpoint before command injection can occur.
Input validation at the application or proxy layer can sanitize or reject malicious payloads targeting the ssdpcgi_main function, though the flaw is in the device firmware itself.