Vulnerability · Published Jul 21, 2025 · Assigned by VulDB

CVE-2025-7932D-Link DIR‑817L ssdpcgi lxmldbc_system command injection

Medium 6.3

In plain English

A medium-severity command injection in DIR‑817L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)5.9%top 6.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
D-Link	DIR‑817L	1.04B01

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-317061 | D-Link DIR‑817L ssdpcgi lxmldbc_system command injection vdb-entry, technical-description
VDB-317061 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #618951 | D-Link DIR‑817L Firmware version <= Firmware v1.04B01 RCE third-party-advisory
https://github.com/Patr1ck-S/Patr1ck-S.github.io/blob/main/D-Link%20DIR%E2%80%91817L%20has%20a%20remote%20arbitrary%20command%20execution%20vulnerability%20in%20ssdpcgi(1).md exploit
https://www.dlink.com/ product