CVE-2025-10440mediumCWE-77CWE-78

CVE-2025-10440: falha de média gravidade em D-Link DI-8100

D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

Publicada em

Seguir esta CVE+ Monitorar DI-8100+ Monitorar DI-8003

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

18Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 13%
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
D-Link · DI-8003D-Link · DI-8003GD-Link · DI-8100D-Link · DI-8100GD-Link · DI-8200D-Link · DI-8200G
CVEs relacionadas — D-Link DI-8100

No mesmo produto, das mais perigosas para as menos.

CVE-2025-10441MEDIUMD-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injectionEPSS 13.7%CVE-2025-3538HIGHD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflowEPSS 13.2%CVE-2025-4544HIGHD-Link DI-8100 jhttpd ddos.asp stack-based overflowEPSS 11.8%CVE-2025-4883HIGHD-Link DI-8100 Connection Limit Page ctxz.asp ctxz_asp stack-based overflowEPSS 8.9%CVE-2024-7436MEDIUMD-Link DI-8100 msp_info.htm msp_info_htm command injectionEPSS 7.8%CVE-2025-7762HIGHD-Link DI-8100 HTTP Request menu_nat_more.asp stack-based overflowEPSS 6.7%