Executive brief
The D-Link DIR-806A router contains a command injection vulnerability in its SSDP (Simple Service Discovery Protocol) request handler that allows unauthenticated remote attackers to execute arbitrary system commands on the device. Exploitation requires only network access to the router's SSDP port and no authentication. Since this product is no longer supported, no patches are available, leaving affected devices permanently vulnerable to complete system compromise.
Technical details
The vulnerability exists in the ssdpcgi_main() function of the SSDP Request Handler component (firmware version FW100CNb11), where the HTTP_ST header from SSDP M-SEARCH requests is directly concatenated into a system() call without any input validation or filtering. An attacker can craft a malicious SSDP request with shell metacharacters in the ST header to inject arbitrary commands (e.g., "urn:device:1;telnetd;#") that are executed with device privileges. The attack vector is network-based via UDP port 1900 (standard SSDP port) and requires no authentication or user interaction. Proof-of-concept code has been publicly released demonstrating exploitation to enable telnet services for shell access. Since the DIR-806A 100CNb11 is end-of-life and no longer maintained, no official patches are available.
Affected products
- D-Link DIR-806A FW100CNb11
Timeline
- 2025-12-31: disclosed
- 2025-12-31: other: Public proof-of-concept exploit released