PT-2025-40906 · D Link · Di-7100G C1

Sheratan

·

Published

2025-10-06

·

Updated

2025-11-19

·

CVE-2025-11338

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions D-Link DI-7100G C1 versions up to 20250928
Description A buffer overflow issue exists in the jhttpd component of D-Link DI-7100G C1. The issue is located in the sub 4C0990 function of the /webchat/login.cgi file. Manipulation of the openid argument can trigger the buffer overflow, allowing for remote code execution. The exploit for this issue has been published.
Recommendations Versions up to 20250928 should be updated to a newer, secure version when available. As a temporary workaround, consider restricting access to the /webchat/login.cgi file to minimize the risk of exploitation. Avoid manipulating the openid argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-12881
CVE-2025-11338

Affected Products

Di-7100G C1