cbcvebase.
CVE-2025-3538
published 2025-04-13

CVE-2025-3538: A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the…

PriorityP268high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
12.09%
95.7th percentile
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdi-8100——
dlinkdi-8100_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/auth.asp↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DI-8100 auth.asp callback Parameter Buffer Overflow Attempt (CVE-2025-3538)"; flow:established,to_server; http.uri; bsize:>200; content:"/auth.asp|3f|callback|3d|"; fast_pattern; startswith; reference:cve,2025-3538; reference:url,github.com/Fizz-L/CVE1/blob/main/DI-8100Command%20execution2.md; classtype:attempted-admin; sid:2061553; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_04_14, cve CVE_2025_3538, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit traffic targets HTTP URI starting with /auth.asp?callback= with a URI length greater than 200 bytes, indicating a buffer overflow attempt via the callback parameter.
  • →Traffic is plaintext HTTP (not TLS), directed inbound to internal network devices — deploy detection at the network perimeter or on internal segments where D-Link DI-8100 devices reside.
  • →The attack must originate from within the local network (LAN-side attack vector), so focus monitoring on internal/lateral traffic to the device's HTTP management interface.
  • ·Affected component is the jhttpd web server on D-Link DI-8100 firmware version 16.07.26A1 specifically; confirm firmware version before applying detection rules to avoid false positives on other D-Link models. ↗
  • ·The Snort/Suricata rule (SID 2061553) is scoped to internal deployment only — ensure $HOME_NET is correctly defined to include D-Link DI-8100 device IP ranges for accurate detection.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.