CVE-2025-26238

Deferred Deferred - Pending Action

Remote Code Execution in D-Link DI-8100G

Publication date: 2026-08-24

Last updated on: 2026-08-28

Assigner: MITRE

Description

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-28

Generated

2026-09-14

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-12

NVD

CVE-2025-26238

EUVD

EUVD-2025-210769

Affected Vendors & Products

Vendor	Product	Version / Range
d-link	di-8100g	17.12.20a1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a remote code execution flaw in the D-Link DI-8100G device running firmware version 17.12.20A1. It exists in the main program jhttpd through the flag parameter in the msp_info function, allowing attackers to inject and execute arbitrary commands on the device.

Detection Guidance

To detect CVE-2025-26238, check if your D-Link DI-8100G device is running firmware version 17.12.20A1. Test for command injection by sending a crafted request to the msp_info function via the flag parameter in jhttpd. Example: curl -X POST 'http://<device_ip>/msp_info?flag=;id' to see if arbitrary commands execute.

Impact Analysis

An attacker could exploit this to gain unauthorized remote access to the device, potentially allowing them to take control of the system, steal data, or use the device as part of a larger attack.

Compliance Impact

This vulnerability allows remote code execution on the D-Link DI-8100G device, which could lead to unauthorized access to sensitive data. Such access may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or protected health information.

Mitigation Strategies

Immediately update the D-Link DI-8100G firmware to a patched version if available. If no patch exists, restrict network access to the device, disable remote administration, and monitor for suspicious activity. Consider replacing the device if updates are not provided.

Hi! I’m here to help you understand CVE-2025-26238. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70