CVE-2025-44084

CRITICAL

D-link DI-8100 16.07.26A1 - OS Command Injection via Crafted HTTP Requests

Title source: llm
STIX 2.1

Description

D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0205
EPSS Percentile 84.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
dlink/di-8100g_firmware 16.07.26a1
Published May 20, 2025
Tracked Since Feb 18, 2026