D-Link DI-8100G CVE-2025-26238

Exploitation requires the attacker to be on the same adjacent network segment as the target D-Link DI-8100G - the CVSS AV:A metric confirms that internet-based exploitation is not possible without first gaining a foothold on the same broadcast domain, VLAN, or directly connected network. No authentication is required per the PR:N CVSS metric, and no user interaction is needed. The specifically vulnerable component is the msp_info CGI handler and its flag parameter in firmware version 17.12.20A1. No non-default configuration appears required - the vulnerable code path is present in the standard firmware installation as documented by the researcher. The primary factor limiting exploitation is adjacency: the attacker must be physically or logically co-located on the same network segment as the device, which meaningfully constrains the threat actor population compared to a fully remote (AV:N) vulnerability.

The CVSS 8.1 (High) score is driven by high confidentiality and integrity impact with no authentication or user interaction required, but the adjacent network (AV:A) constraint is the primary risk limiter - exploitation cannot be conducted from the internet without prior network positioning. The EPSS score of 0.17% (6th percentile) indicates very low observed real-world exploitation at time of analysis, consistent with the absence of a CISA KEV listing. A public proof-of-concept on GitHub modestly elevates the threat above vulnerabilities with no published exploit code, lowering the technical bar for adjacent-network attackers. No vendor advisory or patch has been identified, leaving affected devices without a vendor-supplied fix and making compensating controls the only available mitigation path. The no-authentication adjacency exploitation combined with a public PoC means any network segment hosting an unpatched DI-8100G warrants immediate isolation measures regardless of the low EPSS signal.

An attacker already present on the same LAN segment or VLAN as a D-Link DI-8100G sends a crafted HTTP request to the msp_info CGI endpoint with a malicious value injected into the flag parameter. The injected payload is interpreted and executed as code by the router firmware, granting the attacker full read and write control of the device with no prior credentials. A public proof-of-concept on GitHub demonstrates this technique, reducing the skill threshold required for exploitation.