Cyber Resilience

CVE-2025-8956

LowPublic PoC

Published: 14 August 2025

Published
14 August 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0359 88.0th percentile
Risk Priority 6 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8956 is a low-severity Injection (CWE-74) vulnerability in Dlink Dir-818L Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A vulnerability has been identified in the D-Link DIR-818L router up to firmware version 1.05B01. The issue resides in the getenv function within the /htdocs/cgibin file of the ssdpcgi component and stems from improper handling of input that permits command injection, as classified under CWE-74 and CWE-77.

The flaw can be triggered remotely by an authenticated attacker with low privileges. Successful exploitation allows the injection and execution of arbitrary commands on the affected device, though the CVSS 4.0 score of 2.1 reflects limited impact on confidentiality, integrity, and availability.

Publicly available references include a detailed proof-of-concept on GitHub along with entries in VulDB, but no vendor advisory or patch information is provided in the listed sources. The EPSS score remains flat at 0.0359 with no observed increase after disclosure.

EU & UK References

Vulnerability details

A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been…

more

disclosed to the public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

Command injection in public-facing ssdpcgi CGI (T1190) enables remote arbitrary Unix shell command execution (T1059.004, T1202 via getenv and system call).

CVEs Like This One

CVE-2025-7932Same vendor: Dlink
CVE-2025-14225Same vendor: Dlink
CVE-2025-10689Same vendor: Dlink
CVE-2026-2194Same vendor: Dlink
CVE-2026-2218Same vendor: Dlink
CVE-2026-4203Same vendor: Dlink
CVE-2026-4207Same vendor: Dlink
CVE-2025-10628Same vendor: Dlink
CVE-2025-15192Same vendor: Dlink
CVE-2026-4210Same vendor: Dlink

Affected Assets

dlink
dir-818l firmware
105b01

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly blocks command injection by requiring validation/sanitization of untrusted input to the getenv function in ssdpcgi before command execution occurs.

prevent

Requires timely application of vendor patches or firmware updates that eliminate the publicly disclosed command-injection flaw in DIR-818L up to 1.05B01.

prevent

Restricts the set of commands and resources reachable by the low-privilege authenticated account needed to trigger the getenv flaw, limiting impact even if input validation fails.

References