CVE-2025-10441

MEDIUM

D-Link DI-8100G,DI-8200G,DI-8003G 17.12.20A1/19.12.10A1 - Command I...

Title source: llm
STIX 2.1

Description

A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

References (6)

Core 6
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.323875
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.323875
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.647837
Various Sources product
https://www.dlink.com/

Scores

CVSS v3 6.3
EPSS 0.0039
EPSS Percentile 60.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (6)
D-Link/DI-8003G 17.12.20A1
D-Link/DI-8003G 19.12.10A1
D-Link/DI-8100G 17.12.20A1
D-Link/DI-8100G 19.12.10A1
D-Link/DI-8200G 17.12.20A1
D-Link/DI-8200G 19.12.10A1
Published Sep 15, 2025
Tracked Since Feb 18, 2026