CVE-2025-11335: D-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injection
A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub46409C of the file /mspinfo.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11335?
CVE-2025-11335 is classified as a command injection vulnerability with a high severity rating.
How do I fix CVE-2025-11335?
To remediate CVE-2025-11335, update the D-Link DI-7100G device to a version later than 20250928.
What components are affected by CVE-2025-11335?
CVE-2025-11335 affects the jhttpd component, specifically the function sub_46409C in the /msp_info.htm?flag=qos file.
What kind of attacks can exploit CVE-2025-11335?
CVE-2025-11335 can be exploited through command injection, allowing an attacker to execute arbitrary commands on the affected system.
Is there a workaround for CVE-2025-11335?
There are no known workarounds for CVE-2025-11335; upgrading to a secure version is the only recommended course of action.