What is the CVSS score of CVE-2025-26238?

CVE-2025-26238 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of D-Link DI-8100G are affected by CVE-2025-26238?

D-Link DI-8100G devices running firmware 17.12.20A1 are vulnerable to unauthenticated remote code execution via a crafted parameter in the msp_info handler, enabling attackers to achieve complete…

How to fix or mitigate CVE-2025-26238?

Within 24 hours, conduct a comprehensive inventory of all D-Link DI-8100G devices in production, specifically identifying those running firmware version 17.12.20A1 or earlier. Within 7 days, implement network access controls to restrict connectivity to affected devices from untrusted or adjacent networks, disable the msp_info CGI handler if operationally dispensable, and enable detailed logging for CGI requests. Within 30 days, contact D-Link for firmware availability and security guidance, establish a timeline for patching or device replacement, and document all compensating controls in your change management system.

D-Link DI-8100G CVE-2025-26238

EUVD-2025-210769 HIGH

Code Injection (CWE-94)

2026-08-24 mitre

GHSA-3wq4-pg59-r5hj

RCE Code Injection D-Link N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.8 HIGH

Arbitrary code execution on a network device implies full C/I/A impact; the provided vector's A:N appears to understate availability loss from firmware-level code injection.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 20:42 vuln.today

CVSS changed

Aug 28, 2026 - 20:22 NVD

8.1 (HIGH)

CVE Published

Aug 24, 2026 - 00:00 cve.org

HIGH 8.1

CVE Published

Aug 24, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

AnalysisAI

Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted flag parameter in the msp_info CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.

Technical ContextAI

The D-Link DI-8100G is a network gateway/router device running firmware version 17.12.20A1. The vulnerability resides in the msp_info CGI endpoint, where the flag parameter is processed without adequate sanitization or validation, enabling code injection as classified by CWE-94 (Improper Control of Generation of Code). Rather than a memory-safety flaw, this is a logic-level injection where attacker-controlled input is interpreted as executable code or a command by the firmware. The CVSS attack vector of AV:A (Adjacent Network) confines exploitation to the same broadcast domain - LAN, VLAN, or directly connected segment - rather than being accessible over the open internet. NVD has not assigned a formal CPE string for this firmware (listed as n/a), which is consistent with the vulnerability being reported exclusively via a third-party researcher write-up without a corresponding vendor advisory.

RemediationAI

No vendor-released patch has been identified at time of analysis. Operators should check D-Link's official security advisory portal for any released firmware update addressing this firmware version. As an immediate compensating control, restrict access to the device's management and CGI interfaces at the network perimeter by applying firewall ACLs that block traffic to the msp_info endpoint from untrusted hosts. Placing the device's management interface on an isolated management VLAN accessible only to trusted administrator hosts effectively minimizes the adjacent-network attacker pool, since AV:A exploitation requires shared network segment access. If web-based management is not operationally required, disabling it entirely removes the attack surface at the cost of losing remote administration capability. Reference https://nvd.nist.gov/vuln/detail/CVE-2025-26238 for updated patch or advisory information as it becomes available.