CVE Alert: CVE-2025-9752 – D-Link – DIR-852

Risk verdict

High risk: publicly disclosed remote command-injection with a available proof-of-concept exploit; proceed with urgent mitigations.

Why this matters

The vulnerability enables remote, unauthenticated command execution on a consumer routing device, potentially allowing full device compromise and foothold inside affected networks. With vendor support ended, there is no official patch, elevating risk for organisations using exposed DIR-852 deployments in SMB/branch or home-office environments.

Most likely attack path

• Exploitation requires no user interaction (UI:N) and no privileges (PR:N); attacker can trigger via a crafted request over the SOAP service (AV:N, AC:L).
• Scope remains unchanged, but successful command execution can lead to persistent compromise, data exposure, or lateral movement within the device’s host network.

Who is most exposed

Devices deployed at edge networks with exposed management interfaces, especially in small businesses and homes where this model is common and firmware support has ended.

Detection ideas

• Look for POST requests to soap.cgi with abnormal service parameter values triggering command execution attempts.
• Unusual process activity or new outbound connections shortly after requests to the SOAP endpoint.
• Unexpected system commands spawned by soapcgi_main in logs or host telemetry.
• Anomalous file system activity or shell activity on the device.
• IDS/IPS alerts for known command-injection patterns targeting SOAP services.

Mitigation and prioritisation

• Patch/patching status: no official patch available; plan for device replacement or decommission if possible.
• Compensating controls: restrict external access to the device’s management interfaces; implement strict firewall rules; disable remote administration if not needed.
• Network controls: segment affected devices from sensitive networks; require VPN for administration.
• Monitoring: enable enhanced logging for SOAP endpoints; deploy network-based detection of command-injection patterns.
• Change-management: inventory and tag affected devices; consider upgrade path and procurement that receives ongoing security support. If KEV true or EPSS ≥ 0.5 becomes evidenced, elevate to priority 1.