What is the CVSS score of EUVD-2025-21345?

EUVD-2025-21345 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Di 8100 Firmware are affected by EUVD-2025-21345?

A critical stack-based buffer overflow vulnerability in D-Link DI-8100 routers (model 16.07.26A1) allows remote attackers to execute arbitrary code without authentication.

Is there a public PoC exploit available for EUVD-2025-21345?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21345. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2025-21345?

Within 24 hours: Identify all D-Link DI-8100 devices in production and isolate them from critical network segments; document affected asset inventory. Within 7 days: Implement network access controls restricting HTTP access to /arp_sys.asp endpoint; deploy WAF rules to block exploitation attempts; establish monitoring for suspicious HTTP requests to this file. Within 30 days: Replace affected devices with patched hardware or alternative vendor solutions; contact D-Link for patch availability status; conduct forensic analysis to determine if devices were previously compromised.

Di 8100 Firmware EUVD-2025-21345

| CVE-2025-7602 HIGH

Buffer Overflow (CWE-119)

2025-07-14 cna@vuldb.com

Buffer Overflow D-Link RCE Di 8100 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21345

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 16, 2025 - 14:32 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 12:15 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7602 is a critical stack-based buffer overflow vulnerability in D-Link DI-8100 firmware version 16.07.26A1 affecting the /arp_sys.asp HTTP endpoint. An authenticated remote attacker with high privileges can exploit this vulnerability to achieve arbitrary code execution, potentially compromising device integrity, confidentiality, and availability. Public exploit code is available, elevating real-world risk despite the CVSS 7.2 score.

Technical ContextAI

The vulnerability exists in the HTTP Request Handler component processing the /arp_sys.asp file on D-Link DI-8100 network devices (CPE: cpe:2.3:o:d-link:di-8100_firmware:16.07.26a1:*:*:*:*:*:*:*). The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. This occurs when user-supplied input from HTTP requests is copied into a fixed-size stack buffer without proper bounds checking, allowing an attacker to overflow the buffer and overwrite the stack, potentially hijacking program control flow. The /arp_sys.asp endpoint processes ARP system configuration requests, and the overflow likely stems from inadequate input validation on parameters passed to this ASP handler.

RemediationAI

Immediate actions: (1) Upgrade D-Link DI-8100 firmware to the latest patched version beyond 16.07.26A1; contact D-Link support for availability of security patches (vendor advisory: https://support.d-link.com should be checked for CVE-2025-7602 patch notes); (2) Restrict administrative access to the DI-8100 management interface using network ACLs and VPN, limiting access to trusted administrative IPs only; (3) Disable or restrict HTTP access to /arp_sys.asp endpoint if not required through firewall rules or device-level access controls; (4) Implement strong, unique passwords for all administrative accounts; (5) Monitor device logs for suspicious HTTP requests to /arp_sys.asp with unusual input parameters; (6) Consider network segmentation to isolate the DI-8100 from untrusted administrative networks. Long-term: implement automated firmware update policies and maintain security patch subscriptions with D-Link.