CVE-2025-3538

D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.18.8High EPSS percentile96th13% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2025-04-13Updated 2025-07-16Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

D-Link DI-8100Affected: 16.07.26A1Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your D-Link DI-8100 is running firmware version 16.07.26A1.
Update the DI-8100 firmware to the vendor’s fixed version (per D-Link guidance for this DI-8100 jhttpd auth_asp issue).
If you cannot update immediately, restrict access to the DI-8100 web management interface so it is reachable only from approved internal IP addresses (IP allowlist).
Review your network for unexpected local devices and monitor for repeated or unusual requests to /auth.asp from internal IPs.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.

In plain language

Written by AI from the record

If you run a D-Link DI-8100 (firmware 16.07.26A1), a nearby network attacker could send a specially made message to the device’s /auth.asp page and potentially take over the system—this is a serious risk and you should check for a firmware update.

Unauthenticated stack-based buffer overflow in D-Link DI-8100 firmware 16.07.26A1 jhttpd (auth_asp via the /auth.asp endpoint) is triggered by a crafted 'callback' argument; an attacker on the local network could execute code with the service’s privileges.

If you're affected

Full device takeover
Service disruption
Potential access to internal network
Loss of availability

What is it

This flaw is like a weak spot in a door lock where a carefully crafted “handle” can cause the device to crash or, worse, run attacker-controlled instructions. Because it targets the device’s login-related web page without needing a username/password, someone on your local network could potentially take control or disrupt it.

Who is affected

This matters if your business uses the D-Link DI-8100 router/firmware version 16.07.26A1. It is reachable from the local network and does not require authentication or user action according to the findings. The practical risk depends on whether an attacker can reach the device’s /auth.asp endpoint from your internal network (and whether management access is exposed beyond intended devices).

How urgent is it

This is an AMBER issue: the vulnerability is high-impact because it can allow code execution, and a public PoC exists. Even though it requires local network reachability (not the open internet), attackers inside the same network can try it without any login.

What to do — in detail

Confirm exposure
- Log into the DI-8100 administration UI and check the firmware version.
- If you are on firmware 16.07.26A1, you are in the affected scope described by the findings.
Upgrade (preferred fix)
- Identify the vendor-published firmware update that addresses CVE-2025-3538 for DI-8100.
- Upgrade all DI-8100 units that are on 16.07.26A1.
- After updating, re-check the firmware version to confirm it changed.
- Note: the provided findings don’t include a specific fixed version number, so use the vendor’s release notes/upgrade page for the exact target build.
Compensating control if you can’t upgrade right away
- Use an IP allowlist (“white list”) so only approved IP addresses can reach the DI-8100 web management interface.
- Ensure untrusted or guest/internal devices cannot access the management endpoint.
Practical workaround to reduce probing
- Limit who can reach the router’s management UI from within your network (e.g., only from a dedicated admin workstation subnet).
- If your environment supports it, disable remote management and avoid exposing the management interface on broader network segments.
What to monitor
- Look for unusual or repeated requests to /auth.asp coming from internal IPs.
- Watch for signs of instability (service restarts, crashes, unexpected loss of connectivity) after such requests.
Timeliness
- While this is not listed in CISA KEV (so it’s not confirmed there), the findings include a public PoC. Treat this as a near-term patch item rather than something to defer.

Technical context

CVE-2025-3538 is a stack-based buffer overflow (CWE-119) involving improper handling of input (CWE-121) in the jhttpd component’s auth_asp function for /auth.asp on D-Link DI-8100 firmware 16.07.26A1. The trigger is a crafted 'callback' argument passed to /auth.asp. Authentication is not required and no user interaction is required per the findings. A public PoC exists (1 known), and the predicted likelihood is rising per EPSS, though the findings do not indicate KEV listing or confirmed exploitation in the provided material. The AMBER verdict reflects high potential impact (code execution with the service’s privileges) but constrained reachability to the local network.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

13% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 233 days before any public exploit.

2026-07-05EPSS band change0 → moderateepss band change
2026-03-07Public exploit / PoCsource: github-poc
2025-07-16Patch availablerecord updated
2025-04-13Publishedweakness classified, att&ck mapped

Affected products

D-Link Corp.commercial · TWaka dlink, d-link international, d-link corporation
- di-8100 firmwareNetworking Infrastructure
- DI-8100Networking Infrastructure
D-Linkcommercial · TW
- DI-8100Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector AdjacentRequires access to the local network (e.g. same Wi-Fi, Bluetooth)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable