CVE-2025-11338

HighCVSS 8.8

Published: 06/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.00%

62th percentile - higher than 62% of all known CVEs

Summary

A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 in /webchat/login.cgi of the jhttpd component, where manipulation of the openid argument can lead to buffer overflow. It is possible to launch the attack remotely, and the exploit has been published.

Risk Assessment

Risk of remote code execution or device crash. Public exploit increases the likelihood of attacks on vulnerable devices.

Recommendation

Apply firmware updates if available, or restrict external access to the device. Monitor vendor communications.

Other vulnerabilities in D-Link DI-7100G

CVE-2025-11335Medium
A weakness was identified in D-Link DI-7100G C1 up to 20250928, involving command injection in function sub_46409C of /msp_info.htm?flag=qos in component jhttpd. Manipulation of iface allows remote command execution. The exploit is public.

Original NVD description (English source)

A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the file /webchat/login.cgi of the component jhttpd. Executing manipulation of the argument openid can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS