What is the CVSS score of CVE-2025-7603?

CVE-2025-7603 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Di 8100 Firmware are affected by CVE-2025-7603?

D-Link DI-8100 devices running firmware 16.07.26A1 are vulnerable to remote code execution through a stack-based buffer overflow in the HTTP request handler.

Is there a public PoC exploit available for CVE-2025-7603?

Yes, a public proof-of-concept exploit is available for CVE-2025-7603. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-7603?

Within 24 hours: Identify and inventory all D-Link DI-8100 devices running firmware 16.07.26A1 in your environment; isolate affected devices from production networks if possible or implement emergency network access controls. Within 7 days: Deploy WAF rules to block malicious HTTP requests to /jingx.asp and implement strict network segmentation to limit device accessibility; contact D-Link for patch availability and firmware upgrade timeline. Within 30 days: Execute firmware upgrade to a patched version when available; if upgrade unavailable, implement continuous monitoring for exploitation attempts and evaluate device replacement options.

Di 8100 Firmware CVE-2025-7603

EUVD-2025-21344 HIGH

Buffer Overflow (CWE-119)

2025-07-14 cna@vuldb.com

Buffer Overflow D-Link RCE Di 8100 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21344

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 16, 2025 - 14:32 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 13:15 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. Affected is an unknown function of the file /jingx.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7603 is a critical stack-based buffer overflow vulnerability in D-Link DI-8100 firmware version 16.07.26A1, affecting the HTTP Request Handler component (/jingx.asp file). An authenticated remote attacker with high privileges can exploit this vulnerability to achieve complete compromise of the device, including code execution, data theft, and denial of service. A public proof-of-concept exploit exists, increasing real-world exploitation risk.

Technical ContextAI

The vulnerability resides in the D-Link DI-8100 router's HTTP request handler, specifically within the /jingx.asp file processing. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), manifesting as a stack-based buffer overflow. This occurs when user-supplied input from HTTP requests is copied into a fixed-size stack buffer without proper bounds checking. The affected CPE is likely: cpe:2.3:o:d-link:di-8100_firmware:16.07.26a1:*:*:*:*:*:*:* and cpe:2.3:h:d-link:di-8100:*:*:*:*:*:*:*:*. The HTTP Request Handler component processes unvalidated input, allowing stack memory corruption and potential arbitrary code execution through stack frame manipulation and return address overwriting.

RemediationAI

Immediate actions: (1) Contact D-Link support to determine if firmware patches are available for the DI-8100 device; (2) If firmware updates exist, apply them immediately to the affected device; (3) If no patches are available and the device is end-of-life, strongly consider hardware replacement with a current, supported model; (4) Implement network segmentation to restrict access to device administration interfaces—limit /jingx.asp access to trusted administrative networks only via firewall rules; (5) Enforce strong authentication credentials and disable default passwords on the device; (6) Monitor for suspicious HTTP requests to /jingx.asp with abnormally large payloads or encoded content; (7) Consider disabling remote management features if not required; (8) Review D-Link security advisories at https://www.dlink.com/en/security for any available patches or workarounds; (9) If the device is internet-facing, immediately move it behind a NAT firewall with restricted port access.