CVE-2025-10689: D-Link DIR-645 Firmware RCE Vulnerability

CVE-2025-10689 Overview

A command injection vulnerability has been identified in the D-Link DIR-645 router running firmware version 1.05B01. This issue affects the soapcgi_main function within the /soap.cgi file. Manipulation of the service argument enables attackers to inject and execute arbitrary system commands on the affected device. The vulnerability can be exploited remotely over the network, making it particularly concerning for exposed devices.

Critical Impact

Remote attackers can execute arbitrary commands on the affected router, potentially gaining complete control over the device and using it as a foothold for further network attacks. This vulnerability affects end-of-life products that no longer receive security updates from D-Link.

Affected Products

• D-Link DIR-645 Router
• D-Link DIR-645 Firmware version 1.05B01
• D-Link DIR-645 (all hardware revisions running vulnerable firmware)

Discovery Timeline

• September 18, 2025 - CVE-2025-10689 published to NVD
• October 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10689

Vulnerability Analysis

This command injection vulnerability (CWE-77) exists in the SOAP CGI handler of the D-Link DIR-645 router. The soapcgi_main function processes incoming SOAP requests through the /soap.cgi endpoint without properly sanitizing the service parameter. This lack of input validation allows attackers to inject shell metacharacters and arbitrary commands that are subsequently executed with the privileges of the web server process.

The vulnerability falls under the broader category of injection flaws (CWE-74), where untrusted data is sent to an interpreter as part of a command or query. In embedded devices like routers, such vulnerabilities are particularly severe because they often run with elevated privileges and provide access to critical network infrastructure.

Since this product has reached end-of-life status, D-Link no longer provides security updates, leaving all devices permanently vulnerable unless taken offline or replaced.

Root Cause

The root cause of this vulnerability is insufficient input validation in the soapcgi_main function. The service argument passed to /soap.cgi is incorporated into system commands without proper sanitization or escaping. This allows shell metacharacters such as semicolons, pipes, and backticks to break out of the intended command context and execute attacker-supplied commands.

Attack Vector

The attack can be launched remotely over the network by sending specially crafted SOAP requests to the /soap.cgi endpoint. An attacker with low-level access privileges can exploit this vulnerability without any user interaction. The attack targets the web management interface of the router, which may be exposed on the local network or, in misconfigured deployments, accessible from the internet.

The exploitation process involves crafting a malicious SOAP request with command injection payloads embedded in the service parameter. When processed by the vulnerable soapcgi_main function, the injected commands are executed on the router's operating system.

Technical details regarding the exploitation methodology can be found in the IOT Security Research Document and the VulDB Entry #324813.

Detection Methods for CVE-2025-10689

Indicators of Compromise

• Unusual outbound connections from the router to unknown external IP addresses
• Unexpected processes running on the router if shell access is available for inspection
• Modified router configuration or DNS settings without administrator action
• Suspicious HTTP POST requests to /soap.cgi containing shell metacharacters in logs
• Network traffic anomalies indicating the router is participating in botnet activity

Detection Strategies

• Monitor network traffic for HTTP requests to /soap.cgi containing suspicious patterns such as semicolons, backticks, or pipe characters in parameters
• Implement intrusion detection system (IDS) rules to flag malformed SOAP requests targeting D-Link routers
• Deploy network segmentation to isolate vulnerable IoT devices and monitor cross-segment traffic
• Use web application firewalls (WAF) to inspect and block command injection attempts in SOAP requests

Monitoring Recommendations

• Enable verbose logging on perimeter firewalls to capture all traffic to and from D-Link devices
• Periodically audit router configurations to detect unauthorized modifications
• Monitor DNS queries from the router for connections to known malicious domains
• Implement SIEM rules to correlate suspicious router activity with potential exploitation attempts

How to Mitigate CVE-2025-10689

Immediate Actions Required

• Replace the D-Link DIR-645 with a currently supported router model as this device is end-of-life
• Disable remote management access to the router immediately if replacement is not immediately possible
• Ensure the router's web management interface is not exposed to the internet
• Implement network segmentation to isolate the vulnerable device from critical network assets
• Monitor the device closely for signs of compromise until it can be replaced

Patch Information

No patch is available for this vulnerability. The D-Link DIR-645 has reached end-of-life status and is no longer supported by the manufacturer. D-Link does not provide security updates for discontinued products. The only permanent remediation is to replace the device with a currently supported router model.

For more information, visit the D-Link Official Site.

Workarounds

• Restrict access to the /soap.cgi endpoint using firewall rules at the network perimeter
• Disable the SOAP/UPnP service on the router if not required for network operations
• Place the router behind an additional firewall that can filter and inspect HTTP traffic
• Implement access control lists (ACLs) to limit which IP addresses can communicate with the router's management interface
• Consider deploying a VPN for any required remote management access instead of exposing the router directly

# Example firewall rule to block external access to the vulnerable endpoint
# This should be applied on your perimeter firewall, not the vulnerable device
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -m string --string "/soap.cgi" --algo bm -j DROP

# Alternative: Block all external access to the router management interface
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP