CVE-2025-4340 is a medium severity (CVSS 6.3) command injection in the D-Link DIR-890L and DIR-806A1 routers, in firmware up to 100CNb11 and 108B03. The soap.cgi handler can be abused over the network. The models are no longer supported, so replace them and limit access in the meantime.
What's affected
D-Link DIR-890L and DIR-806A1 firmware up to 100CNb11 and 108B03, per the record. The flaw is in the function sub_175C8 of /htdocs/soap.cgi. The CVE text says the manipulation leads to command injection and that the attack can be launched remotely.
The weaknesses are tagged CWE-74 and CWE-77. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, and low privileges required, so the scoring assumes some form of login. The record also says this vulnerability only affects products that are no longer supported by the maintainer, which means no fixed version is expected.
Command injection means that text sent to a device ends up being run as an operating system command. On a router that means the commands run on the device that controls your network traffic. The record does not describe what an attacker could do with it, and the score of 6.3 reflects a limited impact in its base metrics.
The record gives firmware ranges for two hardware models in one value, written as 100CNb11/108B03, and does not say which value belongs to which model. If you are unsure which applies to your unit, check with D-Link. The record names no fixed firmware, and none is expected.
How to check if you're exposed
Find the device and read its model and firmware version from the web admin page, or from the label on the case. Compare the firmware with the affected range above.
Next, check whether the admin interface answers from outside your network. From a machine on a different network, try the router's public address on its admin port. If a login page appears, remote administration is on.
On a network you own, you can list devices that answer on common router ports.
nmap -sV -p 80,443,1900,8080 --open 192.168.0.0/24
Only scan networks you own or have permission to test.
What to do now
- Locate every unit of this model, including old ones in drawers and at remote sites.
- Plan their replacement with a supported router. The vendor does not support this model, so no patch is expected.
- Until then, turn off remote administration and make the admin page reachable only from the local network.
- Change the admin password to a long unique one.
- If the router has UPnP or similar discovery services you do not need, turn them off.
- If you cannot replace it quickly, put it behind another firewall and keep important systems on a separate network.
- Check D-Link's site for any legacy notice and record the result.
Why it matters
Routers are exposed by design. They sit between a network and the internet and run a web server that is rarely updated. A command injection bug in a firmware handler turns that web server into a way to reach the device's operating system. Because these models are out of support, the risk does not fade with time, and it is cheaper to replace the unit than to defend it.
The sibling CVE-2025-4341 covers the DIR-880L in the same way, and both records point to the same public researcher repository.
The record says the exploit has been disclosed to the public and may be used. It does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), so there is no confirmation here of attacks in the wild. Routers past end of life are a steady target, and the right answer is to replace them.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported by the maintainer, so a patch is not expected. Check D-Link's site for any legacy notice, and plan to replace the device.
Does turning off remote administration solve it?
It reduces exposure a lot, because the flaw is reached over the network. It does not remove the flaw for anyone on your local network, so replacement is still the real fix.
Sources
- Gold entry for CVE-2025-4340
- Gold entry for CWE-74
- Gold entry for CWE-77
- VulDB entry, listed in the CVE record
- D-Link website, listed in the CVE record
The reference pages are linked from the CVE record. Some block automated access, so I could not read their full text.
Last reviewed: 18 October 2026.
