CVE-2025-10628: A vulnerability was found in D-Link DIR-852 1.00CN B09. This vulnerability affects unknown code of the file /htdocs/cgibin/hedwig.cgi of the component Web…

PriorityP272high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

8.85%

94.7th percentile

A vulnerability was found in D-Link DIR-852 1.00CN B09. This vulnerability affects unknown code of the file /htdocs/cgibin/hedwig.cgi of the component Web Management Interface. Performing manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-852	—	—
dlink	dir-852_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/htdocs/cgibin/hedwig.cgi↗

url/hedwig.cgi↗

bytes↗

|3c|service|3e|DEVICE.TIME|3c 2f|service|3e|

bytes↗

|3c|server|3e|

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link hedwig.cgi (DEVICE.TIME) server XML Parameter Command Injection Attempt (CVE-2025-10628)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:11; content:"/hedwig.cgi"; http.request_body; content:"|3c|service|3e|DEVICE.TIME|3c 2f|service|3e|"; fast_pattern; content:"|3c|server|3e|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x7c|%7[Cc])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|telnetd|wget|curl|sh|cat|busybox)+/R"; reference:url,github.com/i-Corner/cve/issues/31; reference:cve,2025-10628; classtype:attempted-admin; sid:2064800; rev:1;)

→Exploit uses HTTP POST method targeting /hedwig.cgi (exactly 11 bytes) on the D-Link DIR-852 Web Management Interface.
→Malicious POST body contains an XML <service>DEVICE.TIME</service> element — use this as a fast-pattern anchor for detection.
→Command injection payload is embedded inside the XML <server> element; look for shell metacharacters or known attack binaries (telnetd, wget, curl, sh, cat, busybox) following the <server> tag in the request body.
→MITRE mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190) — prioritise internet-exposed D-Link DIR-852 devices running firmware 1.00CN B09.

·The vulnerability affects D-Link DIR-852 firmware 1.00CN B09, which is end-of-life and no longer supported by the vendor — no patch will be issued. ↗
·The Snort/Suricata rule (SID 2064800) targets plaintext HTTP only; HTTPS-wrapped management interfaces will not be detected by this rule without TLS inspection.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.