D-Link DIR-806A CVE-2025-15391

Exploitation requires: (1) network connectivity to the affected DIR-806A 100CNb11 router, (2) valid authentication credentials (PR:L indicates low-privilege authenticated access, typically the 'admin' user or equivalent account), and (3) the target router must be running the specific vulnerable firmware version 100CNb11. Exploitation does NOT require administrator-level credentials - low-privilege user accounts can trigger the vulnerability. The attack targets the SSDP Request Handler specifically, which may be accessible via the web administration interface or directly via SSDP protocol mechanisms if the router accepts remote SSDP queries (non-default but possible in certain network configurations). The vulnerability does not affect routers running other firmware versions of the DIR-806A or routers that have been updated beyond 100CNb11, and it does not affect other D-Link router models. Devices no longer powered on or removed from service are not vulnerable by definition.

This vulnerability presents minimal real-world risk despite moderate attack surface. The CVSS 4.0 vector shows remote network access (AV:N) with low attack complexity (AC:L) but crucially requires authenticated user privileges (PR:L), significantly reducing the threat model compared to unauthenticated network exploits. The impact scope is narrow - only low integrity and availability consequences (VC:L/VI:L/VA:L) with no scope escalation - suggesting the attacker gains limited command execution context, likely confined to the SSDP service user or restricted process. The EPSS score of 0.11% (29th percentile) is exceptionally low, indicating minimal probability of widespread exploitation despite public POC availability. This contradiction between available POC and low EPSS reflects the vulnerability's limited applicability: it affects only unsupported DIR-806A 100CNb11 firmware on end-of-life hardware, reducing the vulnerable target population substantially. Organizations running current D-Link firmware or alternative router models face no risk. The E:P rating (exploit maturity: proof-of-concept) confirms public exploit availability but does not indicate active large-scale exploitation.

An attacker with network access who obtains or guesses valid credentials for the DIR-806A web administration interface could craft a malicious SSDP request containing shell metacharacters (e.g., pipe operators, command substitution syntax) in a parameter field expected by the ssdpcgi_main function. Upon processing this request, the unvalidated input is passed to a system command execution function, allowing the attacker to execute arbitrary commands on the router with the privileges of the SSDP service process. The publicly available exploit code demonstrates this attack vector.