CVE-2025-8956
Published: 14 August 2025
Summary
CVE-2025-8956 is a low-severity Injection (CWE-74) vulnerability in Dlink Dir-818L Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability has been identified in the D-Link DIR-818L router up to firmware version 1.05B01. The issue resides in the getenv function within the /htdocs/cgibin file of the ssdpcgi component and stems from improper handling of input that permits command injection, as classified under CWE-74 and CWE-77.
The flaw can be triggered remotely by an authenticated attacker with low privileges. Successful exploitation allows the injection and execution of arbitrary commands on the affected device, though the CVSS 4.0 score of 2.1 reflects limited impact on confidentiality, integrity, and availability.
Publicly available references include a detailed proof-of-concept on GitHub along with entries in VulDB, but no vendor advisory or patch information is provided in the listed sources. The EPSS score remains flat at 0.0359 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24799
Vulnerability details
A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been…
more
disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing ssdpcgi CGI (T1190) enables remote arbitrary Unix shell command execution (T1059.004, T1202 via getenv and system call).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks command injection by requiring validation/sanitization of untrusted input to the getenv function in ssdpcgi before command execution occurs.
Requires timely application of vendor patches or firmware updates that eliminate the publicly disclosed command-injection flaw in DIR-818L up to 1.05B01.
Restricts the set of commands and resources reachable by the low-privilege authenticated account needed to trigger the getenv flaw, limiting impact even if input validation fails.