Paper/Archive/CVE-2025-11338

CVE-2025-11338

D-Link DI-7100G C1 — D-Link DI-7100G C1 jhttpd login.cgi sub_4C0990 buffer overflow

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 63.3.633 × 2012.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the file /webchat/login.cgi of the component jhttpd. Executing manipulation of the argument openid can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

Affected

ProductAffectedFixed inSource

DI-7100G C120250928–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

VulDB (CNA)8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

VulDB (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.327221 refvuldb.com/?ctiid.327221 writeupvuldb.com/?submit.664619 exploityuque.com/jh0ng/vmpda6/kggo2ngrcphzvwml refdlink.com