CVE-2025-11335

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-06

Last updated on: 2026-04-29

Assigner: VulDB

Description

A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-06

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-10-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11335

EUVD

EUVD-2025-32169

Affected Vendors & Products

Vendor	Product	Version / Range
dlink	di-7100g_c1_firmware	2025-09-28
dlink	di-7100g_c1	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in the D-Link DI-7100G C1 router's jhttpd service, specifically in the function sub_46409C accessed via the /msp_info.htm?flag=qos endpoint. It occurs because the 'iface' parameter is not properly sanitized, allowing an attacker to inject arbitrary system commands remotely. This can be exploited by an attacker with some level of authentication to execute commands on the device. [1, 2]

Impact Analysis

The vulnerability can impact the confidentiality, integrity, and availability of the affected device. An attacker exploiting this flaw can execute arbitrary commands remotely, potentially taking control of the device, disrupting its operation, or accessing sensitive information. The attack is considered easy to execute and a proof-of-concept exploit is publicly available. [2]

Detection Guidance

This vulnerability can be detected by monitoring or testing the jhttpd service on the D-Link DI-7100G C1 device, specifically by checking the /msp_info.htm endpoint with the query parameter flag=qos and the iface argument for signs of command injection. Since the vulnerability involves command injection via the iface parameter, one could attempt to send crafted requests to this endpoint to observe unexpected command execution or responses. However, no specific detection commands are provided in the available resources. [1, 2]

Mitigation Strategies

Immediate mitigation steps include replacing the affected D-Link DI-7100G C1 device with an alternative product, as no known mitigations or countermeasures have been identified. Since the vulnerability allows remote command injection and exploitation is easy, avoiding use of the vulnerable device or restricting access to the jhttpd service endpoint may reduce risk until replacement is possible. [2]

Hi! I’m here to help you understand CVE-2025-11335. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70