CVE-2025-11335
BaseFortify
Publication date: 2025-10-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | di-7100g_c1_firmware | 2025-09-28 |
| dlink | di-7100g_c1 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in the D-Link DI-7100G C1 router's jhttpd service, specifically in the function sub_46409C accessed via the /msp_info.htm?flag=qos endpoint. It occurs because the 'iface' parameter is not properly sanitized, allowing an attacker to inject arbitrary system commands remotely. This can be exploited by an attacker with some level of authentication to execute commands on the device. [1, 2]
How can this vulnerability impact me? :
The vulnerability can impact the confidentiality, integrity, and availability of the affected device. An attacker exploiting this flaw can execute arbitrary commands remotely, potentially taking control of the device, disrupting its operation, or accessing sensitive information. The attack is considered easy to execute and a proof-of-concept exploit is publicly available. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing the jhttpd service on the D-Link DI-7100G C1 device, specifically by checking the /msp_info.htm endpoint with the query parameter flag=qos and the iface argument for signs of command injection. Since the vulnerability involves command injection via the iface parameter, one could attempt to send crafted requests to this endpoint to observe unexpected command execution or responses. However, no specific detection commands are provided in the available resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected D-Link DI-7100G C1 device with an alternative product, as no known mitigations or countermeasures have been identified. Since the vulnerability allows remote command injection and exploitation is easy, avoiding use of the vulnerable device or restricting access to the jhttpd service endpoint may reduce risk until replacement is possible. [2]