CVE-2025-9026 is a High severity (CVSS 7.3) OS command injection in the SSDP service of the D-Link DIR-860L router, firmware 2.04.B04. The record says the product is no longer supported by the maintainer, so replacing the router is the dependable fix.
What's affected
The record lists D-Link DIR-860L firmware 2.04.B04. The function ssdpcgi_main in htdocs/cgibin, part of the Simple Service Discovery Protocol component, is the weak spot, and the manipulation leads to OS command injection. The record scores it 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction. It says the exploit has been disclosed to the public and may be used.
The record also says this vulnerability only affects products that are no longer supported by the maintainer. The reporter issue we read names the Rev.B hardware on that firmware (an ic5b hotfix build), shows no vendor response or patch, and remains open. It suggests input validation and an allowlist of SSDP values, which is a recommendation rather than a fix. We could not confirm any fixed version.
How to check if you're exposed
- Look at the router label and the admin page. Confirm the model is DIR-860L and note the hardware revision and firmware version.
- If it is firmware 2.04.B04, treat it as affected.
- Check D-Link's support site for the model's status and for newer firmware. For an end of support product there may be none.
- Check whether the router is reachable from the internet and whether UPnP or discovery services are enabled on the WAN side.
What to do now
- Plan to replace the router with a supported model. The vendor will not be fixing it, per the record.
- Until then, disable remote management and any discovery or UPnP service you do not need.
- Keep the router's admin password strong and unique.
- Put an upstream firewall in front of it if you can, so the device is not directly reachable from the internet.
- Move sensitive systems to a separate network that does not trust this router.
- Add the model to your end of life register so the next one is caught before the CVE arrives.
Why it matters
The weakness class is CWE-78 (OS command injection) and its parent CWE-77. A service that takes network input builds a shell command from it, so the input can change what the device runs. SSDP is a discovery protocol on the local network, and a flaw there is attractive because discovery services are often enabled by default.
The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and we found no advisory saying it is exploited. The real issue is the unsupported status. A router at end of life collects unpatched flaws, and each new one has no remedy.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Will D-Link release a fix for CVE-2025-9026?
The record says the product is no longer supported by the maintainer, and we found no patch. Plan to replace the device.
Is this exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability. It does say the exploit is public.
Sources
Last reviewed: 18 October 2026.
