CVE-2025-7908 HIGH

CVE-2025-7908: D-Link DI-8100 jhttpd ddns.asp sprintf stack-based overflow

Vendor D-Link

Product DI-8100

Weakness CWE-121

Published July 20, 2025

Last update July 21, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp?opt=add of the component jhttpd. The manipulation of the argument mx leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

July 20, 2025 CVE published

July 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-7908 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2025-5855 Tenda AC6 SetRebootTimer formSetRebootTimer stack-based overflow CVE-2024-6146 Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2023-41214 D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2014-0770 Advantech WebAccess Stack-based Buffer Overflow CVE-2024-6403 Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflow