CVE-2025-11338: falha de alta gravidade em D-Link DI-7100G C1
D-Link DI-7100G C1 jhttpd login.cgi sub_4C0990 buffer overflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.0%
A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the file /webchat/login.cgi of the component jhttpd. Executing manipulation of the argument openid can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
D-Link · DI-7100G C1CVEs relacionadas — D-Link DI-7100G C1
No mesmo produto, das mais perigosas para as menos.
CVE-2025-11335MEDIUMD-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injectionEPSS 4.6%CVE-2026-2194MEDIUMD-Link DI-7100G C1 start_proxy_client_email command injectionEPSS 4.4%CVE-2026-2193MEDIUMD-Link DI-7100G C1 set_jhttpd_info command injectionEPSS 4.0%CVE-2025-11339HIGHD-Link DI-7100G C1 jhttpd hi_block.asp sub_4BD4F8 buffer overflowEPSS 1.0%