CVE-2025-8956
Published: 14 August 2025
Summary
CVE-2025-8956 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dir-818L Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing ssdpcgi CGI (T1190) enables remote arbitrary Unix shell command execution (T1059.004, T1202 via getenv and system call).
NVD Description
A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been…
more
disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-8956 is a command injection vulnerability in D-Link DIR-818L routers up to version 1.05B01. The flaw affects the getenv function in the /htdocs/cgibin file of the ssdpcgi component, where manipulation enables arbitrary command execution. It is classified under CWE-74 and CWE-77, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an attacker who has low privileges, such as an authenticated user with minimal access. Exploitation requires network access and low complexity but no user interaction, allowing the attacker to achieve limited impacts on confidentiality, integrity, and availability through injected commands.
Advisories are documented on VulDB (ctiid.319925, id.319925, submit.627835), with a GitHub repository detailing the remote arbitrary command execution exploit in the ssdpcgi component. The D-Link website is referenced for further information, though specific patch or mitigation guidance is not detailed in the available descriptions.
The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)