CVE-2025-10440
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-09-15 10:15:32.233000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-10440",
"sourceIdentifier": "[email protected]",
"published": "2025-09-15T10:15:32.233",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "es",
"value": "Se ha encontrado una vulnerabilidad en D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 y DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Afectada por esta vulnerabilidad es la función sub_4621DC del archivo usb_paswd.asp del componente jhttpd. La manipulación del argumento hname conduce a inyección de comandos del sistema operativo. El ataque puede ser iniciado remotamente. El exploit ha sido divulgado al público y puede ser utilizado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "D-Link",
"product": "DI-8100",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DI-8100G",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DI-8200",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DI-8200G",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DI-8003",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DI-8003G",
"modules": [
"jhttpd"
],
"versions": [
{
"version": "16.07.26A1",
"status": "affected"
},
{
"version": "17.12.20A1",
"status": "affected"
},
{
"version": "19.12.10A1",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-15T16:27:43.933970Z",
"id": "CVE-2025-10440",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md",
"source": "[email protected]"
},
{
"url": "https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md#exp",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.323874",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.323874",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.647835",
"source": "[email protected]"
},
{
"url": "https://www.dlink.com/",
"source": "[email protected]"
}
]
}