PT-2025-38291 · D Link · D-Link Dir-852

Ic0Rner · Published 2025-09-09 · Updated 2025-09-18 · CVE-2025-10629

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-852 version 1.00CN B09

Description A flaw exists in the Simple Service Discovery Protocol Service component of the D-Link DIR-852. The issue resides in the ssdpcgi main function within the htodcs/cgibin file. Manipulation of the ST argument can lead to command injection, potentially allowing for remote execution. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations As a temporary workaround, consider disabling the Simple Service Discovery Protocol Service until a patch is available.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2025-12536

CVE-2025-10629

Affected Products

D-Link Dir-852

References · 11

• 🔥 https://github.com/i-Corner/cve/issues/30 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10629 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12536 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10629 · Security Note
• https://twitter.com/CVEnew/status/1968561151765012546 · Twitter Post
• https://t.me/cveNotify/135747 · Telegram Post
• https://t.me/CVEtracker/32817 · Telegram Post
• https://vuldb.com/?ctiid.324659 · Note
• https://vuldb.com/?submit.650660 · Note
• https://vuldb.com/?id.324659 · Note
• https://dlink.com · Note