cbcvebase.
CVE-2025-10441
published 2025-09-15

CVE-2025-10441: A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file…

PriorityP260medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
12.11%
95.7th percentile
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

Affected

6 ranges
VendorProductVersion rangeFixed in
d-linkdi-8003g——
d-linkdi-8003g——
d-linkdi-8100g——
d-linkdi-8100g——
d-linkdi-8200g——
d-linkdi-8200g——

Detection & IOCsextracted from sources · hover to see the quote

path/version_upgrade.asp
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link version_upgrade.asp path Parameter Command Injection Attempt (CVE-2025-10441)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/version_upgrade.asp|3f|"; startswith; fast_pattern; content:"path|3d|"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_2.md#poc; reference:cve,2025-10441; classtype:attempted-admin; sid:2064693; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_09_15, cve CVE_2025_10441, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Detect HTTP GET requests to /version_upgrade.asp with a 'path' parameter containing OS command injection metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24).
  • →The vulnerable component is the jhttpd web server on D-Link DI-8100G, DI-8200G, and DI-8003G devices (firmware 17.12.20A1 / 19.12.10A1); the injection point is the 'path' argument handled by function sub_433F7C in version_upgrade.asp. ↗
  • →The attack is unauthenticated and remotely exploitable via plaintext HTTP; deploy detection at both perimeter and internal network boundaries.
  • →A public PoC exploit exists; treat any matching traffic as high-severity attempted admin access (MITRE T1190 – Exploit Public-Facing Application). ↗
  • ·Affected firmware versions are specifically 17.12.20A1 (DI-8100G/DI-8200G) and 19.12.10A1 (DI-8003G); the Snort/ET rule targets plaintext HTTP only and will not fire on HTTPS-wrapped management interfaces. ↗

CVSS provenance

nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.