CVE-2025-10441mediumCWE-77CWE-78

CVE-2025-10441: medium-severity vulnerability in D-Link DI-8100G

D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection

Published

Follow this CVE+ Monitor DI-8200G+ Monitor DI-8003G

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 14%
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
D-Link · DI-8003GD-Link · DI-8100GD-Link · DI-8200G
Related CVEs — D-Link DI-8100G

In the same product, most dangerous first.

CVE-2025-10440MEDIUMD-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injectionEPSS 13.4%CVE-2026-0732MEDIUMD-Link DI-8200G upgrade_filter.asp command injectionEPSS 11.7%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.8%