CVE-2025-44084

CVE-2025-44084 is an unauthenticated command injection flaw (CWE-77) in D-Link DI-8100 router firmware, with build 16.07.26A1 identified as vulnerable; the CPE tagging also references the DI-8100G, so defenders should treat both model references as affected. The flaw is triggered by specially crafted HTTP requests sent to the device's web management interface, and per the CVSS vector (AV:N/PR:N) no authentication or user interaction is required. A successful attacker gains the highest-privilege shell on the firmware system, giving full control of the router. Any operator running the affected firmware is exposed, especially where the router's management interface is reachable from the WAN or the internet. As of now there is no public proof-of-concept and the issue is not in CISA KEV, but EPSS places it in the 97th percentile with a 20.1% probability of exploitation within 30 days, so near-term exploitation is considered likely even though no confirmed in-the-wild activity is reported.

What to do: Check D-Link's advisories for a firmware release superseding 16.07.26A1 and upgrade, since no fixed build is specified in the available data. Until patched, disable or restrict WAN-side web management so the router's HTTP interface is reachable only from trusted LAN networks. Given the unauthenticated, network-facing nature and high EPSS, prioritize internet-exposed units and review them for unexpected processes or configuration changes that would indicate compromise.