CVE-2025-10441CWE-77CWE-78command-injection

CVE-2025-10441

Medium · published September 15, 2025

CVSS v3.1
6.3
EPSS
13%
Percentile
96.4
In the wild
Unconfirmed
What it is

A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.13365 · 96.4th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-15T15:15Z
References (6)
https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_2.md · [email protected]https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_2.md#poc · [email protected]https://vuldb.com/?ctiid.323875 · [email protected]https://vuldb.com/?id.323875 · [email protected]https://vuldb.com/?submit.647837 · [email protected]https://www.dlink.com/ · [email protected]
EPSS history
Timeline
  • 15 SEP 10:32Z
    D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection
    cvelistv5