CVE-2025-11338 is a high severity (8.8) buffer overflow in the D-Link DI-7100G C1, up to firmware 20250928. The openid argument of /webchat/login.cgi in the jhttpd component is affected. The record names no fixed firmware, so cut off remote exposure and check D-Link support for an update.
What's affected
The record lists the D-Link DI-7100G C1 and its firmware, up to build 20250928. The affected function is sub_4C0990 in /webchat/login.cgi, part of the jhttpd web component, and the openid argument triggers it. CVSS 8.8 (high severity), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Fixed versions: none are named in the record. Check the D-Link support page for this model for a newer firmware and any security notice.
How to check if you're exposed
Log in to the device and read the firmware build under system information. Builds up to 20250928 are in scope. Then check whether the web management service is reachable from the internet or from guest networks.
nmap -p 80,443,8080 YOUR_ROUTER_ADDRESS
Run that from outside your network only against devices you own. An open management port on the WAN side is the highest priority to close.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Turn off remote web management on the WAN side, and limit it to a management VLAN.
- Check the D-Link support page for the DI-7100G C1 for firmware newer than 20250928, and apply it after reading the notes.
- If no fix exists, plan replacement. Network edge devices with public exploit details deserve a short deadline.
- Back up the configuration before any firmware change.
- Watch device logs for unexpected reboots, which can follow memory corruption attempts.
Why it matters
The record classes this as CWE-119 (memory buffer bounds), CWE-120 (classic buffer overflow). The login handler copies the openid value into a fixed size memory area without checking its length. Memory corruption on a network device can crash it, and in the worst cases give an attacker control.
Edge devices are hard to monitor and slow to patch, and public exploit details make them targets for scanners. The record says the exploit has been published. It is not on CISA KEV in the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there fixed firmware?
The record names none. Check D-Link support for the DI-7100G C1 and limit remote management.
Why is a buffer overflow serious on a router?
Memory corruption on a network device can crash it or let an attacker run code on a box that sits at your network edge.
Sources
Last reviewed: 19 October 2026.
