A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
References
| Link | Resource |
|---|---|
| https://github.com/ccc-iotsec/cve-/blob/D-Link/D-Link%20DIR-806A%E6%9C%AA%E6%8E%88%E6%9D%83RCE.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.339152 | Permissions Required VDB Entry |
| https://vuldb.com/?id.339152 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.727637 | Third Party Advisory VDB Entry |
| https://www.dlink.com/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
14 Jan 2026, 20:44
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dlink dir-806a Firmware
Dlink Dlink dir-806a |
|
| CPE | cpe:2.3:o:dlink:dir-806a_firmware:100cnb11:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-806a:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/ccc-iotsec/cve-/blob/D-Link/D-Link%20DIR-806A%E6%9C%AA%E6%8E%88%E6%9D%83RCE.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.339152 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.339152 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.727637 - Third Party Advisory, VDB Entry | |
| References | () https://www.dlink.com/ - Product |
31 Dec 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-31 18:15
Updated : 2026-01-14 20:44
NVD link : CVE-2025-15391
Mitre link : CVE-2025-15391
CVE.ORG link : CVE-2025-15391
JSON object : View
Products Affected
dlink
- dir-806a_firmware
- dir-806a