Cyber Resilience

CVE-2025-7192

LowPublic PoC

Published: 08 July 2025

Published
08 July 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0207 84.3th percentile
Risk Priority 5 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7192 is a low-severity Injection (CWE-74) vulnerability in Dlink Dir-645 Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).

Deeper analysis

A vulnerability classified as critical exists in D-Link DIR-645 routers up to firmware version 1.05B01. It resides in the ssdpcgi_main function within the /htdocs/cgibin file of the ssdpcgi component and stems from improper handling of input that permits command injection, corresponding to CWE-74 and CWE-77. The flaw is remotely triggerable and affects devices that are no longer supported by the vendor.

An authenticated remote attacker can supply crafted input to the affected function to execute arbitrary commands on the device. Publicly disclosed exploit code demonstrates that successful exploitation yields limited control over the system, consistent with the CVSS 2.1 rating that reflects low impact across confidentiality, integrity, and availability.

The EPSS score remains flat at 0.0207 with no material increase after disclosure. References indicate the issue was reported through public channels including a detailed GitHub proof-of-concept, but no vendor patches or mitigation guidance are available because the product line is unsupported.

EU & UK References

Vulnerability details

A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely.…

more

The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

Remote command injection in the router's public-facing ssdpcgi CGI enables exploitation of public-facing applications (T1190), network device CLI command execution (T1059.008), and indirect command execution (T1202) as explicitly noted in advisories.

CVEs Like This One

CVE-2025-10689Same product: Dlink Dir-645
CVE-2025-15191Same vendor: Dlink
CVE-2025-10401Same vendor: Dlink
CVE-2026-0732Same vendor: Dlink
CVE-2025-15192Same vendor: Dlink
CVE-2026-1125Same vendor: Dlink
CVE-2026-2163Same vendor: Dlink
CVE-2025-13562Same vendor: Dlink
CVE-2025-10123Same vendor: Dlink
CVE-2025-7932Same vendor: Dlink

Affected Assets

dlink
dir-645 firmware
≤ 1.05b01

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires replacement or approved compensating controls for unsupported system components such as the end-of-life D-Link DIR-645 with no patches available.

prevent

Boundary protection (firewalls, segmentation, ACLs) blocks unauthenticated remote access to the vulnerable ssdpcgi CGI endpoint before command injection can occur.

prevent

Input validation at the application or proxy layer can sanitize or reject malicious payloads targeting the ssdpcgi_main function, though the flaw is in the device firmware itself.

References