CVE-2025-10441
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected is the function sub_433F7C of the file version_upgrade.asp of the jhttpd component. Manipulation of the path argument results in OS command injection. The attack may be launched remotely and the exploit has been made public.
Risk Assessment
A remote attacker may execute arbitrary OS commands on the device, taking control of it. Public exploit availability increases the risk.
Recommendation
Update the device firmware to a version containing the vendor fix or restrict access to the management interface. Isolate devices from untrusted networks.
Other vulnerabilities in jhttpd
See all- CVE-2025-10440Medium
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected is the function sub_4621DC of the file usb_paswd.asp of the jhttpd component. Manipulation of the hname argument leads to OS command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.
- CVE-2025-9745Medium
A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the jhttpd component. Manipulation of the path argument leads to OS command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.
Original NVD description (English source)
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS