CVE-2025-9727
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A weakness was identified in D-Link DIR-816L version 206b01 in the soapcgi_main function of /soap.cgi. Manipulating the service argument leads to OS command injection. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, taking control of it. The product is no longer supported by the maintainer, so a fix is unlikely to be released.
Recommendation
Since the product is no longer supported, consider replacing the device with a supported model. Until then, restrict access to the management interface and isolate the device from untrusted networks.
Other vulnerabilities in D-Link DIR-816L
See all- CVE-2025-13188Critical
D-Link DIR-816L version 2_06_b09_beta contains a stack-based buffer overflow vulnerability in the function authenticationcgi_main of the file /authentication.cgi. Manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation is possible, and the exploit is public. This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2025-13191High
A vulnerability was found in D-Link DIR-816L version 2_06_b09_beta in the soapcgi_main function of /soap.cgi, causing a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer.
- CVE-2025-13190High
D-Link DIR-816L 2_06_b09_beta is affected by a stack-based buffer overflow in the scandir_main function of /portal/__ajax_exporer.sgi via manipulation of the en argument. The attack can be performed remotely and a public exploit exists.
- CVE-2025-13189High
A vulnerability was found in D-Link DIR-816L version 2_06_b09_beta in the genacgi_main function of gena.cgi. Manipulation of the SERVER_ID/HTTP_SID arguments leads to a stack-based buffer overflow. The attack can be carried out remotely, the exploit has been publicly disclosed, and the vulnerability only affects products no longer supported by the maintainer.
Original NVD description (English source)
A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgi_main of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS