PT-2025-40913 · D Link · Di-7100G C1

Sheratan · Published 2025-10-06 · Updated 2025-11-19 · CVE-2025-11339

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DI-7100G C1 versions up to 20250928

Description A flaw exists in the jhttpd component of D-Link DI-7100G C1. The issue is due to a buffer overflow in the sub 4BD4F8 function within the /webchat/hi block.asp file. The popupId argument can be manipulated to trigger this overflow, allowing for remote exploitation. The exploit has been publicly disclosed.

Recommendations Versions up to 20250928 should be updated. As a temporary workaround, consider restricting access to the /webchat/hi block.asp file. Avoid using the popupId argument in the affected file until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-12877

CVE-2025-11339

Affected Products

Di-7100G C1

References · 12

• 🔥 https://yuque.com/jh0ng/vmpda6/zr11zfssl8h74bn3#Wjajr · Exploit
• https://bdu.fstec.ru/vul/2025-12877 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11339 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11339 · Vendor Advisory
• https://vuldb.com/?ctiid.327222 · Note
• https://yuque.com/jh0ng/vmpda6/zr11zfssl8h74bn3 · Note
• https://vuldb.com/?id.327222 · Note
• https://t.me/cveNotify/143429 · Telegram Post
• https://twitter.com/CVEnew/status/1975241128006840338 · Twitter Post
• https://vuldb.com/?submit.664635 · Note
• https://twitter.com/VulmonFeeds/status/1975345237045240180 · Twitter Post
• https://dlink.com · Note