CVE-2025-9727 is a medium severity OS command injection flaw (CVSS 6.3) in the D-Link DIR-816L, firmware 206b01. The service argument handled by /soap.cgi can lead to command execution. The record says the product is no longer supported, so plan to replace the device and reduce its exposure now.
What's affected
The record lists D-Link DIR-816L version 206b01 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which describes a network attack with low complexity, but it needs a low privilege account and no user interaction.
Fixed versions: none. The record states that this product is no longer supported by its maintainer, so no patch should be expected.
How to check if you're exposed
Log in to the router admin page and read the model and firmware version. Compare it with the record: DIR-816L, firmware 206b01. If the model matches, assume you are exposed.
Then check whether the admin interface or the UPnP and SOAP service is reachable from the internet. From a machine outside your network, scan only your own public address.
nmap -p 80,443,8080 YOUR_PUBLIC_IP
Any open port that answers with the router login page or a SOAP endpoint is a problem. Only scan addresses you own.
If you also build software for devices like this, the free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track third party components and look up CVEs by id. They do not scan a router's installed firmware.
What to do now
- Turn off remote administration, and do not expose the device web interface to the internet.
- Place the device behind another firewall or isolate it on its own network segment while you plan its replacement.
- The record says the product is unsupported, so budget for a replacement from a vendor that still ships firmware updates.
- Change the admin password and review settings for changes you did not make.
- Record the device in your asset list with an end of support date so it does not fade from view.
Why it matters
The weakness is CWE-77 (Command Injection) and CWE-78 (OS Command Injection). The soap.cgi handler takes the service value and passes it into a command without safe handling. Router firmware often runs with full privileges, so command execution there means control of the device and of the traffic that crosses it.
This is a network device, so the issue lives in firmware on equipment at the edge of a home or office network, not in a web application you can patch with a package update.
The record says an exploit has been made public. This CVE is not in the CISA Known Exploited Vulnerabilities catalog and nothing I fetched claims active attacks. Even so, end of life routers with public exploit details are a common target for botnet operators, which is why exposure matters more than the score.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I fix this with a firmware update?
Only if the vendor ships one. The record says the product is no longer supported, so replacement is the realistic fix.
What reduces the risk right away?
Turn off remote administration and keep the device's web interface off the internet.
Sources
- Gold page for CVE-2025-9727
- NVD record data for CVE-2025-9727, as held in the Safeguard content batch
- Reporter write-up: https://github.com/scanleale/IOT_sec/blob/main/DIR-816L.pdf
Source note: the only advisory material I could read for this CVE is a PDF write-up from the reporter, which I fetched. It is a researcher report, not a vendor advisory, and it does not name a fixed version.
Last reviewed: 18 October 2026.
