Description
A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
Published: 2025-05-11
Score: 7.5 High
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-14978 A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
History

Thu, 22 May 2025 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink di-8100
Dlink di-8100 Firmware
Weaknesses CWE-787
CPEs cpe:2.3:h:dlink:di-8100:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:di-8100_firmware:*:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink di-8100
Dlink di-8100 Firmware

Mon, 12 May 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 11 May 2025 18:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
Title D-Link DI-8100 jhttpd ddos.asp stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:N/AC:H/Au:M/C:C/I:C/A:C'}

cvssV3_0

{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Dlink Di-8100 Di-8100 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-05-12T18:58:45.569Z

Reserved: 2025-05-10T15:21:02.977Z

Link: CVE-2025-4544

cve-icon Vulnrichment

Updated: 2025-05-12T18:58:33.171Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-11T19:15:50.450

Modified: 2025-05-22T18:24:37.697

Link: CVE-2025-4544

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses