CVE-2025-10440mediumCWE-77CWE-78

CVE-2025-10440: fallo de gravedad media en D-Link DI-8100

D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

Publicada el

Seguir esta CVE+ Monitorear DI-8100+ Monitorear DI-8003

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 13%
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
D-Link · DI-8003D-Link · DI-8003GD-Link · DI-8100D-Link · DI-8100GD-Link · DI-8200D-Link · DI-8200G
CVEs relacionadas — D-Link DI-8100

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-10441MEDIUMD-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injectionEPSS 13.7%CVE-2025-3538HIGHD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflowEPSS 13.2%CVE-2025-4544HIGHD-Link DI-8100 jhttpd ddos.asp stack-based overflowEPSS 11.8%CVE-2025-4883HIGHD-Link DI-8100 Connection Limit Page ctxz.asp ctxz_asp stack-based overflowEPSS 8.9%CVE-2024-7436MEDIUMD-Link DI-8100 msp_info.htm msp_info_htm command injectionEPSS 7.8%CVE-2025-7762HIGHD-Link DI-8100 HTTP Request menu_nat_more.asp stack-based overflowEPSS 6.7%