CVE-2025-4544CWE-119CWE-121

D-Link DI-8100 jhttpd ddos.asp stack-based overflow

High · published May 11, 2025

CVSS v4.0

7.5

EPSS

12%

Percentile

96.1

In the wild

Unconfirmed

What it is

A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.

The record

Technical detail

CVSS v4.0: 7.5 · HIGH
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.11819 · 96.1th percentile
Weaknesses: CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published: 2025-05-11T18:31Z

EPSS history

Timeline

11 MAY 18:31Z
D-Link DI-8100 jhttpd ddos.asp stack-based overflow
cvelistv5