CVE-2018-6530: D-Link DIR router soap.cgi OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote OS command injection with a 9.8 CVSS score, confirmed in-the-wild exploitation, KEV listing and near-certain EPSS probability.

What it is

soap.cgi (soapcgi_main in cgibin) on several D-Link DIR router models fails to sanitize the service parameter, allowing OS command injection. The flaw is remotely reachable without authentication and carries a CVSS 3.1 score of 9.8, so any exposed device is at immediate risk of full compromise.

Impact

An attacker can execute arbitrary OS commands on the router, gaining full control of the device and its network position. That enables traffic interception, credential capture and use of the router as a pivot into the internal network.

Attack surface

Reached over the network via the SOAP interface on soap.cgi; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Devices with the web management interface exposed to the internet are directly reachable.

Exploitation

CISA added it to KEV on 2022-09-08 with known ransomware campaign use, EPSS 30-day probability is 0.96682 (99.88th percentile), and a public third-party exploit reference exists. Exploitation is confirmed in the wild.

What to do

• Apply the vendor firmware updates referenced in the D-Link advisories; D-Link states the fix under CVE-2018-20114 properly patches this issue.
• If the model is end-of-life and unsupported, disconnect it or replace it, as CISA directs.
• Remove internet exposure of the router web/SOAP management interface and restrict administration to the LAN.
• Segment or isolate these routers on the network and monitor them as untrusted devices until patched or replaced.

Detection

• Inspect HTTP requests to soap.cgi for shell metacharacters or unexpected content in the service parameter.
• Alert on outbound connections or processes spawned by the router's web/cgi service that are not normal management traffic.
• Monitor for router configuration changes, new admin accounts or DNS settings that were not made by administrators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.