VulnerabilityAnalyzed
CVE-2025-11335
A weakness has been identified in D-Link DI-7100G C1 up to 20250928.
LOW 2.0EPSS 4.64%
Does this matter?
Lower severity and a low EPSS score (4.64%). Track it; it rarely justifies an emergency change on its own.
Description
A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
- CVSS 4.0
- 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.64% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- dlink/di-7100g c1 firmware
- Source
- cna@vuldb.com
References
- https://vuldb.com/?ctiid.327218Permissions Required, VDB Entry
- https://vuldb.com/?id.327218Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.664597Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
- https://www.yuque.com/jh0ng/vmpda6/fpqlhpkb0orgseavPermissions Required
- https://www.yuque.com/jh0ng/vmpda6/fpqlhpkb0orgseav#DOhrVPermissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.