CVE-2025-10440CWE-77CWE-78command-injection

CVE-2025-10440

Medium · published September 15, 2025

CVSS v3.1
6.3
EPSS
12%
Percentile
96.2
In the wild
Unconfirmed
What it is

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.12387 · 96.2th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-15T14:15Z
References (6)
https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md · [email protected]https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md#exp · [email protected]https://vuldb.com/?ctiid.323874 · [email protected]https://vuldb.com/?id.323874 · [email protected]https://vuldb.com/?submit.647835 · [email protected]https://www.dlink.com/ · [email protected]
EPSS history
Timeline
  • 15 SEP 10:02Z
    D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection
    cvelistv5