CVE-2025-13562 is a high severity OS command injection flaw (CVSS 7.3) in D-Link DIR-852 router 1.00, affecting the /gena.cgi handler, through the service argument. No patch is expected because the product is out of support, so retire or isolate it.
What's affected
The affected component is the /gena.cgi handler, through the service argument. According to the record, manipulating that argument leads to command injection and the attack can be started remotely.
Affected version: 1.00. The record says this only affects products that are no longer supported by the maintainer, so no fixed version should be expected.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-74, CWE-77.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
This is device firmware, so the check is about inventory and exposure rather than a package version. Find out whether you have this model, which firmware it runs, and whether its management interface can be reached from outside.
- Log in to the device administration page and note the model name and firmware version. Compare it with the version in this post.
- From a machine outside your network, test whether the device web interface answers on its public address. If it does, that is your first thing to close.
- Check your asset list or DHCP leases for the device type, because routers in branch offices and homes are often missing from inventories.
nmap -p 80,443,8080 YOUR_PUBLIC_IP
Only scan addresses you own or are authorised to test. If the management page answers from the internet, restrict it before doing anything else.
What to do now
- Identify every D-Link DIR-852 unit and the firmware it runs.
- Turn off remote administration, and make sure the web interface is only reachable from a trusted management network.
- Change default or shared administrator passwords. The CVSS vector for this record needs no login, so passwords alone will not protect you and limiting who can reach the interface matters most.
- Segment the device so that a compromise of the router does not give access to internal servers.
- Check the vendor support page for newer firmware, and apply it after reading the release notes.
- If the vendor never ships firmware, plan to replace the device with a supported model.
Why it matters
Command injection is the case where input reaches a system command without being neutralised, so the device runs more than the feature intended. The weakness maps to CWE-74, CWE-77. It is a recurring problem on embedded devices, where web handlers often pass form values toward system calls.
Routers sit at the edge of the network, which raises the cost of any bug that runs code on them. A device that forwards your traffic and has a flaw in its management interface deserves the same patching attention as a server, even though few teams track it that way.
Try it yourself
The demo shows a dynamic scan of a running web application, the kind of check that finds exposed endpoints and injection points.
Click through it at your own pace, or open it full screen.
Quick check
Why does the score depend on logging in?
The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. A low or high privilege requirement lowers the score, but credentials on consumer-grade routers are often weak or shared, so do not treat it as protection.
What if the vendor never ships a fix?
The record says this only affects products that are no longer supported by the maintainer, so no fixed version should be expected. In that case the options are to isolate the device from untrusted networks or replace it with a supported model.
Sources
- Gold vulnerability page for CVE-2025-13562
- CVE record for CVE-2025-13562 as published by its CNA, with a published date of 2025-11-23
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
