CVE-2025-11335: A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file…

PriorityP261high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

4.75%

90.8th percentile

A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	di-7100g_c1	—	—
dlink	di-7100g_c1_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/msp_info.htm?flag=qos↗

url/msp_info.htm

commandGET /msp_info.htm?flag=qos&iface=<shell_metachar>

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link msp_info.htm Multiple Parameters Command Injection Attempt (CVE-2025-11335, CVE-2025-6899, CVE-2024-44414, CVE-2024-44402)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/msp_info.htm|3f|"; startswith; fast_pattern; content:"flag|3d|"; distance:0; pcre:"/^(?:cmd|qos)/R"; pcre:"/(?:cmd|iface)\x3d[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/"; reference:cve,2024-44414; reference:cve,2025-11335; reference:cve,2024-44402; reference:cve,2025-6899; reference:url,www.cve.org/CVERecord/SearchResults?query=msp_info.htm; classtype:attempted-admin; sid:2065059; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_06, cve CVE_2024_44414_CVE_2025_11335_CVE_2024_44402_CVE_2025_6899, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Exploit targets the 'iface' parameter in GET requests to /msp_info.htm with flag=qos; inject shell metacharacters (;, newline, backtick, pipe, $) to achieve command injection via the jhttpd process (function sub_46409C). ↗
→Snort/Suricata SID 2065059 (ET, rev:1, created 2025-10-06) detects this attack. Match on HTTP GET to URI starting with /msp_info.htm? followed by flag=cmd or flag=qos, and cmd or iface parameter containing URL-encoded or raw shell metacharacters: semicolon (%3B/;), newline (%0A/\n), backtick (%60/`), pipe (%7C/|), dollar sign (%24/$).
→Attack is plaintext HTTP (tls_state: plaintext), inbound to the device; deploy detection at the network perimeter and internally targeting networking equipment.
→The exploit is publicly available; treat any inbound GET to /msp_info.htm on D-Link DI-7100G C1 devices (firmware up to 20250928) as high-priority. ↗

·The Snort rule covers multiple related CVEs (CVE-2025-11335, CVE-2025-6899, CVE-2024-44414, CVE-2024-44402) under a single SID; a trigger does not exclusively confirm CVE-2025-11335 — correlate with the specific 'iface' parameter and flag=qos to narrow attribution.
·Affected firmware is D-Link DI-7100G C1 up to version 20250928; verify device model and firmware version before applying detections to avoid false positives on other D-Link product lines. ↗

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.05.8MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.