cbcvebase.
CVE-2025-10440
published 2025-09-15

CVE-2025-10440: A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this…

PriorityP259medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
12.11%
95.7th percentile
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

18 ranges
VendorProductVersion rangeFixed in
d-linkdi-8003——
d-linkdi-8003——
d-linkdi-8003——
d-linkdi-8003g——
d-linkdi-8003g——
d-linkdi-8003g——
d-linkdi-8100——
d-linkdi-8100——
d-linkdi-8100——
d-linkdi-8100g——
d-linkdi-8100g——
d-linkdi-8100g——
d-linkdi-8200——
d-linkdi-8200——
d-linkdi-8200——
d-linkdi-8200g——
d-linkdi-8200g——
d-linkdi-8200g——

Detection & IOCsextracted from sources · hover to see the quote

url/usb_paswd.asp↗
urlhttps://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link usb_paswd.asp hname Parameter Command Injection Attempt (CVE-2025-10440)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/usb_paswd.asp|3f|"; startswith; fast_pattern; pcre:"/^.*(?:h)?name\x3d[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md; reference:cve,2025-10440; classtype:attempted-admin; sid:2064694; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_09_15, cve CVE_2025_10440, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Target the HTTP GET request to /usb_paswd.asp with the `hname` (or `name`) parameter containing OS command injection metacharacters: semicolon (`;` / `%3B`), newline (`\n` / `%0A`), backtick (`` ` `` / `%60`), pipe (`|` / `%7C`), or dollar sign (`$` / `%24`). ↗
  • →The vulnerable component is the `jhttpd` web server process handling `usb_paswd.asp`; monitor for unexpected child processes spawned by jhttpd as evidence of successful command injection. ↗
  • →The attack is unauthenticated and remotely initiated via HTTP GET; deploy the Snort/Suricata rule SID 2064694 at perimeter and internal chokepoints for plaintext HTTP traffic targeting D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G devices. ↗
  • →The manipulation of the `hname` argument is the injection point; look for URL-encoded shell metacharacters in the `hname` query parameter of requests to `/usb_paswd.asp`. ↗
  • ·The Snort/Suricata rule (SID 2064694) is scoped to plaintext HTTP only (`tls_state plaintext`); HTTPS-wrapped traffic to the device's management interface will NOT be detected by this rule. ↗
  • ·Affected firmware versions are 16.07.26A1, 17.12.20A1, and 19.12.10A1 across six device models (DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003, DI-8003G); ensure detection coverage is applied to all variants. ↗
  • ·The exploit has been publicly disclosed; treat any probe of `/usb_paswd.asp` with shell metacharacters in query parameters as high-confidence malicious activity. ↗

CVSS provenance

nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.