CVE-2025-44084

CRITICAL EPSS 96.8%

Published May 20, 20251y ago · Modified Jun 17, 20261w ago

9.8 CVSS 3.1

Critical

Published May 20, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

96.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-77 Command Injection Injection

Affected Products 2

Vendor	Product	Version	Range
dlink	di-8100g_firmware	16.07.26a1	any
dlink	di-8100	*	any

References 1

github.com https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md

Broken Link

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.