CVE-2025-4341 is a medium severity (CVSS 6.3) command injection in the D-Link DIR-880L router, firmware up to 104WWb01. The request header handler of ssdpcgi passes input to a command. The model is no longer supported, so replace the router and limit access in the meantime.
What's affected
D-Link DIR-880L firmware up to 104WWb01, per the record. The flaw is in the function sub_16570 of /htdocs/ssdpcgi, in the component the record calls the Request Header Handler. The record says manipulation of the arguments HTTP_ST, REMOTE_ADDR, REMOTE_PORT and SERVER_ID leads to command injection, and that the attack can be launched remotely.
The weaknesses are tagged CWE-74 and CWE-77. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, and low privileges required, so the scoring assumes some form of login. The record also says this vulnerability only affects products that are no longer supported by the maintainer, which means no fixed version is expected.
The inputs named in the record are header and connection values, which a client sends and a server should never trust. Values like these end up in a command when a handler builds one by joining strings, which is the usual cause of command injection.
The record gives no fixed firmware, and none is expected for an unsupported model. The path points at the part of the router that handles SSDP, the discovery protocol used by UPnP. If your router lets you turn off UPnP, doing so is a sensible step, though it does not replace retiring the device.
How to check if you're exposed
Find the device and read its model and firmware version from the web admin page, or from the label on the case. Compare the firmware with the affected range above.
Next, check whether the admin interface answers from outside your network. From a machine on a different network, try the router's public address on its admin port. If a login page appears, remote administration is on.
On a network you own, you can list devices that answer on common router ports.
nmap -sV -p 80,443,1900,8080 --open 192.168.0.0/24
Only scan networks you own or have permission to test.
What to do now
- Locate every unit of this model, including old ones in drawers and at remote sites.
- Plan their replacement with a supported router. The vendor does not support this model, so no patch is expected.
- Until then, turn off remote administration and make the admin page reachable only from the local network.
- Change the admin password to a long unique one.
- If the router has UPnP or similar discovery services you do not need, turn them off.
- If you cannot replace it quickly, put it behind another firewall and keep important systems on a separate network.
- Check D-Link's site for any legacy notice and record the result.
Why it matters
Routers sit between a network and the internet and run a web server that is rarely updated. A command injection bug in a firmware handler gives a path to the device's operating system. Because the model is out of support, the risk does not fade, and replacing the unit costs less than defending it.
The sibling CVE-2025-4340 covers the DIR-890L and DIR-806A1 in the same way, and both records point to the same public researcher repository.
The record says the exploit has been disclosed to the public and may be used. It does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), so there is no confirmation here of attacks in the wild. Routers past end of life are a steady target, and the right answer is to replace them.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported by the maintainer, so a patch is not expected. Check D-Link's site for any legacy notice, and plan to replace the device.
Does turning off remote administration solve it?
It reduces exposure a lot, because the flaw is reached over the network. It does not remove the flaw for anyone on your local network, so replacement is still the real fix.
Sources
- Gold entry for CVE-2025-4341
- Gold entry for CWE-74
- Gold entry for CWE-77
- VulDB entry, listed in the CVE record
- D-Link website, listed in the CVE record
The reference pages are linked from the CVE record. Some block automated access, so I could not read their full text.
Last reviewed: 18 October 2026.
