CVE-2025-11335

MediumCVSS 4.7

Published: 06/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.64%

91th percentile - higher than 91% of all known CVEs

Summary

A weakness was identified in D-Link DI-7100G C1 up to 20250928, involving command injection in function sub_46409C of /msp_info.htm?flag=qos in component jhttpd. Manipulation of iface allows remote command execution. The exploit is public.

Risk Assessment

Remote attack may allow arbitrary command execution on the device, potentially compromising network security.

Recommendation

Update the device software to the latest version and restrict access to the administrative panel.

Other vulnerabilities in D-Link DI-7100G

CVE-2025-11338High
A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 in /webchat/login.cgi of the jhttpd component, where manipulation of the openid argument can lead to buffer overflow. It is possible to launch the attack remotely, and the exploit has been published.

Original NVD description (English source)

A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS