CVE-2025-11338
Published: 06 October 2025
Summary
CVE-2025-11338 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Di-7100G C1 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the buffer overflow in /webchat/login.cgi by applying vendor patches or firmware updates to eliminate the vulnerability.
Information input validation enforces bounds checking and sanitization on the 'openid' argument to prevent buffer overflows in the jhttpd component.
Memory protection mechanisms like address space layout randomization and stack canaries mitigate exploitation of the buffer overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web application (/webchat/login.cgi) on D-Link router allows remote exploitation for initial access via arbitrary code execution.
NVD Description
A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the file /webchat/login.cgi of the component jhttpd. Executing manipulation of the argument openid can lead to buffer overflow. It is possible…
more
to launch the attack remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2025-11338 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting the D-Link DI-7100G C1 router in versions up to 20250928. The flaw resides in the sub_4C0990 function within the /webchat/login.cgi file of the jhttpd component, where manipulation of the "openid" argument triggers the overflow. Published on 2025-10-06, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers possessing low privileges, such as authenticated users, with low attack complexity and no user interaction required. Successful exploitation can result in high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution or full system compromise.
Advisories provide details via VulDB entries (https://vuldb.com/?ctiid.327221, https://vuldb.com/?id.327221, https://vuldb.com/?submit.664619), D-Link's site (https://www.dlink.com/), and additional resources (https://www.yuque.com/jh0ng/vmpda6/kggo2ngrcphzvwml). An exploit has been published and may be used, heightening the urgency for affected users to monitor for updates.
Details
- CWE(s)