Critical severity · published May 20, 2025
CVE-2025-44084
D-link DI-8100 16.07.26A1 is vulnerable to Command Injection
9.8
CVSS
22.6%
EPSS
No
On KEV
Description
D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)22.6% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Di-8100g Firmware · Dlink
16.07.26a1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-44084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-44084
Broken Link
https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md
More from Di-8100g Firmware
9.8
CVE-2024-44401
D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file
9.8
CVE-2024-44402
D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm
7.5
CVE-2025-52222
D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI-8100 v16.07.26A1,…
7.2
CVE-2025-4883
A vulnerability was found in D-Link DI-8100 16.07.26A1