CVE-2025-10689 is a medium severity command injection flaw (CVSS 6.3) in the D-Link DIR-645 router, version 105B01, in soap.cgi. The record says the product is no longer supported by its maintainer, so no fix should be expected. Plan to replace the device and restrict its management access.
What's affected
The record lists the D-Link DIR-645 at firmware 105B01. The vulnerable function is soapcgi_main in /soap.cgi, and the argument is service.
The record states the vulnerability only affects products that are no longer supported by the maintainer. That means a vendor patch is unlikely. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, and low privileges required.
How to check if you're exposed
Log in to the router administration page and note the model and firmware version, usually on the status page. Check whether the web administration interface is reachable from the WAN side.
Then check D-Link support for an end of life notice for the model. The record says the product is unsupported, so the answer is probably that no newer firmware exists.
What to do now
- Plan to replace the DIR-645 with a supported router. No fixed firmware is indicated.
- Turn off remote administration, and make sure the SOAP and web interfaces are not exposed to the internet.
- Place the device behind another firewall if replacement will take time.
- Change the administrator password, and check for unfamiliar settings such as DNS servers or port forwards.
- Record the device as end of life in your asset register.
Why it matters
This is CWE-77, command injection, a child of the injection class CWE-74. Router web handlers sometimes pass request values into shell commands, and a missing check lets those values change the command.
The score of 6.3 is moderate because the vector requires low privileges. But devices like this often keep default or weak passwords, so the practical bar can be lower. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
The record says the exploit is publicly available. That means details are public, not that attacks are confirmed.
Planning for software with no vendor fix
When no patched version is named, you have three options: fix it yourself, shield it, or retire it. Fixing it yourself works well for small PHP applications, since the change is usually one query. Shielding means network controls and a firewall rule. Retiring means moving to a maintained alternative.
Whichever you choose, write the decision down with an owner and a review date. Unpatched software tends to be forgotten rather than decided on. Continuous monitoring of your inventory against new advisories makes sure a fix, if one appears later, does not slip past you.
How scoring and records can mislead
A CVSS score is a starting point. It describes the flaw in general, not your deployment. Two things can move your real risk in either direction: whether the vulnerable component is reachable from where attackers sit, and what the process can touch once compromised.
Also keep in mind that records for newly published CVEs are often thin. Some state a vendor name and a file and little else. When the advisory is short, rely on your own inventory and on defensive basics, and revisit the record as details are added.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported by the maintainer, so a fix is unlikely. Check the D-Link support page to be sure.
What is the safest short term step?
Turn off remote administration, keep the web interface off the internet, and replace the router.
Sources
- Safeguard Gold entry for CVE-2025-10689
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://github.com/scanleale/IOT_sec/blob/main/DIR-645-soapcgi.pdf
- https://www.dlink.com/
- https://vuldb.com/?ctiid.324813
- https://vuldb.com/?id.324813
Last reviewed: 19 October 2026.
