RCE in Dlink Di-8100

CVE-2025-44084

D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.226 (97.7th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-44084: rose from 0.201 to 0.226.

EPSS over last 30 days · oldest: 0.201 · newest: 0.226 · change: +0.026

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-44084?
CVE-2025-44084 is a critical-severity vulnerability in Dlink Di-8100, classified under Command Injection. CVSS score: 9.8/10. Published 2025-05-20.
How severe is CVE-2025-44084?
Critical severity. CVSS v3 base score is 9.8 out of 10.