CVE-2025-10441: falha de média gravidade em D-Link DI-8100G
D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 14%
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVEs relacionadas — D-Link DI-8100G
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10440MEDIUMD-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injectionEPSS 13.4%CVE-2026-0732MEDIUMD-Link DI-8200G upgrade_filter.asp command injectionEPSS 11.7%CVE-2025-6899MEDIUMD-Link DI-7300G+/DI-8200G msp_info.htm os command injectionEPSS 4.8%