CVE-2025-9752
Published: 01 September 2025
Summary
CVE-2025-9752 is a medium-severity Command Injection (CWE-77) vulnerability in Dlink Dir-852 Firmware. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
A security vulnerability identified as CVE-2025-9752 affects the D-Link DIR-852 router running firmware version 1.00CN B09. The flaw resides in the soapcgi_main function within the soap.cgi file of the SOAP service component, where improper handling of the service argument enables OS command injection. The issue is tracked under CWE-77 and CWE-78, carries a CVSS 4.0 score of 5.5, and impacts only devices that are no longer supported by the vendor.
An unauthenticated attacker can exploit the vulnerability remotely by sending a crafted request to the SOAP endpoint, resulting in arbitrary command execution on the device with limited impact to confidentiality, integrity, and availability. Public exploit code has been released, allowing potential use by threat actors with network access to the affected router.
The device is explicitly noted as unsupported, with no vendor patches or mitigations referenced in available advisories. The associated EPSS score remains low and unchanged at 0.0129, indicating limited observed exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28885
Vulnerability details
A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgi_main of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The attack can be…
more
launched remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection in public-facing SOAP service on router enables exploitation of public-facing application (T1190), Unix shell execution (T1059.004), network device CLI abuse equivalent (T1059.008), and indirect command execution (T1202) as noted in advisory.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by requiring validation of untrusted inputs like the manipulated 'service' argument in SOAP requests.
Prohibits or restricts use of unsupported system components such as the end-of-life D-Link DIR-852 firmware exclusively affected by this vulnerability.
Requires timely identification, reporting, and remediation of known flaws like CVE-2025-9752, including mitigations for unpatchable EOL firmware.