CVE-2025-10441 in DI-8100G
Summary
by MITRE • 09/15/2025
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2025
This vulnerability exists within the D-Link DI-8100G, DI-8200G, and DI-8003G network devices running firmware versions 17.12.20A1 and 19.12.10A1. The issue is located in the jhttpd web server component specifically within the version_upgrade.asp file at function sub_433F7C. The flaw represents a critical os command injection vulnerability that allows remote attackers to execute arbitrary system commands on the affected devices. The vulnerability stems from improper input validation where the path argument is directly incorporated into system commands without adequate sanitization or escaping mechanisms. This type of vulnerability is classified under CWE-77 as "Improper Neutralization of Special Elements used in a Command ('Command Injection')", which is a well-documented weakness in software security practices.
The operational impact of this vulnerability is severe as it enables remote code execution without authentication, allowing attackers to gain complete control over the affected network devices. An attacker can leverage this vulnerability to execute arbitrary commands with the privileges of the web server process, which typically runs with elevated permissions on the device. This could lead to unauthorized access to the network, data exfiltration, modification of network configurations, or use of the device as a pivot point for further attacks within the network infrastructure. The public availability of exploitation tools significantly increases the risk as automated attacks can be deployed without specialized knowledge of the specific vulnerability.
Security professionals should consider this vulnerability in the context of the MITRE ATT&CK framework, particularly under the T1059.001 technique for command and scripting interpreter. The attack surface is broad as the vulnerability allows for remote exploitation through web-based interfaces, making it accessible to attackers regardless of their physical location. Mitigation strategies should include immediate firmware updates from D-Link to address the command injection flaw, network segmentation to limit access to these devices, and implementation of network monitoring to detect suspicious command execution patterns. Additionally, organizations should enforce strict input validation on all user-supplied data and implement web application firewalls to filter malicious payloads targeting such vulnerabilities. The vulnerability highlights the importance of secure coding practices and proper input sanitization in embedded web applications, particularly those handling user-provided parameters that may be used in system command execution contexts.