RCE in D-Link Di-8003
CVE-2025-10440
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.118 (95.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- D-link Di-8003 — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
- D-link Di-8003g — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
- D-link Di-8100 — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
- D-link Di-8100g — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
- D-link Di-8200 — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
- D-link Di-8200g — versions 16.07.26A1, 17.12.20A1, 19.12.10A1
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (related)
- cna@vuldb.com (exploit)
- cna@vuldb.com (product)
Frequently asked questions
- What is CVE-2025-10440?
- CVE-2025-10440 is a medium-severity vulnerability in D-Link Di-8003, classified under Command Injection. CVSS score: 6.3/10. Published 2025-09-15.
- How severe is CVE-2025-10440?
- Medium severity. CVSS v3 base score is 6.3 out of 10.