CVE-2025-11339: A vulnerability has been found in D-Link DI-7100G C1 up to 20250928. This issue affects the function sub_4BD4F8 of the file /webchat/hi_block.asp of the…

PriorityP265high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.88%

54.9th percentile

A vulnerability has been found in D-Link DI-7100G C1 up to 20250928. This issue affects the function sub_4BD4F8 of the file /webchat/hi_block.asp of the component jhttpd. The manipulation of the argument popupId leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	di-7100g_c1	—	—
dlink	di-7100g_c1_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/webchat/hi_block.asp↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link hi_block.asp Multiple Parameters Buffer Overflow Attempt (CVE-2025-11338, CVE-2025-11339)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webchat/hi_block.asp|3f|"; startswith; fast_pattern; pcre:"/(?:popupId|openid)\x3d[^&]{100,}(?:&|$)/"; reference:url,www.yuque.com/jh0ng/vmpda6/zr11zfssl8h74bn3#password%20is%20%22gstn%22; reference:cve,2025-11338; reference:cve,2025-11339; reference:url,www.yuque.com/jh0ng/vmpda6/kggo2ngrcphzvwml#password%20is%20%22orn0%22; classtype:web-application-attack; sid:2065060; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_06, cve CVE_2025_11338_CVE_2025_11339, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Exploit targets the 'popupId' (CVE-2025-11339) and 'openid' (CVE-2025-11338) GET parameters in /webchat/hi_block.asp on D-Link DI-7100G C1 jhttpd; a parameter value of 100 or more characters indicates a buffer overflow attempt.
→Traffic is plaintext HTTP (not TLS); detection should be applied at the perimeter and internally on inbound HTTP GET requests to the device's web management interface.
→The vulnerable function is sub_4BD4F8 inside the jhttpd component; binary-level analysis or firmware inspection should focus on this symbol.
→The attack is remotely initiated and the exploit has been publicly disclosed; treat any oversized popupId or openid parameter to hi_block.asp as high-confidence exploitation.

·The Snort/ET rule (sid:2065060) covers both CVE-2025-11338 and CVE-2025-11339 simultaneously via the same URI pattern; tuning or splitting may be needed if per-CVE attribution is required.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.