PT-2025-22244 · D Link · D-Link Di-8100

Published 2025-05-20 · Updated 2025-05-21 · CVE-2025-44084

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-link DI-8100 version 16.07.26A1

Description The issue allows an attacker to exploit a Command Injection flaw by crafting specific HTTP requests. This triggers the command execution flaw and can provide the attacker with the highest privilege shell access to the firmware system.

Recommendations For D-link DI-8100 version 16.07.26A1, consider restricting access to the HTTP request handling mechanism until a patch is available. As a temporary workaround, avoid using the vulnerable firmware version and wait for an official update from the manufacturer. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-05864

CVE-2025-44084

Affected Products

D-Link Di-8100

References · 6

• 🔥 https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-44084 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44084 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05864 · Security Note
• https://twitter.com/CVEnew/status/1924881337078427876 · Twitter Post
• https://twitter.com/transilienceai/status/1925184199515857215 · Twitter Post