Di-500wf Firmware CVEs and Security Vulnerabilities

CVE-2025-9745

D-Link DI-500WF jhttpd version_upgrade.asp os command injection

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.1 Medium EPSS 12.7% KEV · Not listed

Vendors

D-link Dlink

Products

Di-500wf Di-500wf Di-500wf Firmware

CVE-2025-7194

D-Link DI-500WF jhttpd ip_position.asp sprintf stack-based overflow

A vulnerability was found in D-Link DI-500WF 17.04.10A1T. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file ip_position.asp of the component jhttpd. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed