D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection
Published Sep 18, 2025 · Updated Oct 23, 2026
Original summary
Normalized public record · Updated Oct 23, 2026
D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- VDB-324659 | D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection ↗
- VDB-324659 | CTI Indicators (IOB, IOC, TTP, IOA) ↗
- Submit #650660 | D-Link DIR-852 1.00CN B09 Command Injection ↗
- Source repository ↗
- www.dlink.com ↗
Record history
Published Sep 18, 2025 · Last refreshed Oct 23, 2026