CVE-2025-4341

D-Link DIR-880L firmware up to and including 104WWb01 contains a command injection vulnerability (CWE-74/CWE-77) in the request-header handler of the ssdpcgi component, specifically function sub_16570 in /htdocs/ssdpcgi. An attacker triggers it by sending manipulated values in the HTTP_ST, REMOTE_ADDR, REMOTE_PORT or SERVER_ID arguments processed by that component. Successful exploitation allows a remote attacker to inject and execute arbitrary commands on the router. Only the DIR-880L is affected, and the model is end-of-life, so it no longer receives vendor support or fixes. An exploit has been publicly disclosed and may be used; the issue is not in CISA KEV, carries a CVSS 4.0 base score of 5.3, and EPSS estimates roughly a 21% probability of exploitation within 30 days (97th percentile).

What to do: D-Link no longer supports the DIR-880L, so a patched firmware may never be released; confirm your unit's firmware version (everything up to 104WWb01 is affected) and treat the device as vulnerable. As a mitigation, restrict access to the router's web/ssdpcgi-facing interface (for example by disabling UPnP and avoiding WAN-side management exposure) and plan replacement with a currently supported model. Monitor D-Link's support pages in case an end-of-life firmware update is issued.