Cyber Posture

CVE-2025-9026

HighPublic PoC

Published: 15 August 2025

Published
15 August 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0087 75.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9026 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-860L Firmware. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

The OS command injection in the SSDP CGI handler (ssdpcgi_main) enables remote exploitation of a public-facing application (T1190), indirect command execution via the vulnerable function (T1202), and arbitrary Unix shell command execution (T1059.004).

NVD Description

A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The…

more

exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Deeper analysisAI

CVE-2025-9026 is an OS command injection vulnerability (CWE-77, CWE-78) affecting the ssdpcgi_main function in the htdocs/cgibin file of the Simple Service Discovery Protocol component within D-Link DIR-860L firmware version 2.04.B04. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and ease of exploitation.

Unauthenticated remote attackers can exploit this vulnerability by manipulating SSDP-related inputs to inject arbitrary OS commands. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as executing commands on the device.

Advisories from VulDB and a GitHub issue disclose the exploit publicly, with details available at referenced URLs including vuldb.com/?ctiid.320091 and github.com/i-Corner/cve/issues/17. The vulnerability only affects products no longer supported by D-Link, so no patches or mitigations are provided by the maintainer.

This issue is notable as the public exploit disclosure increases risk for exposed, end-of-life DIR-860L devices still in use.

Details

CWE(s)

Affected Products

dlink
dir-860l firmware
2.04.b04

CVEs Like This One

CVE-2025-9752Same vendor: Dlink
CVE-2026-2175Same vendor: Dlink
CVE-2026-2210Same vendor: Dlink
CVE-2026-2260Same vendor: Dlink
CVE-2026-2081Same vendor: Dlink
CVE-2026-2157Same vendor: Dlink
CVE-2026-4465Same vendor: Dlink
CVE-2026-2143Same vendor: Dlink
CVE-2026-2084Same vendor: Dlink
CVE-2026-2152Same vendor: Dlink

References