CVE-2025-9938HIGH 8.8EPSS p68.9%

CVE-2025-9938CVE-2025-9938

Description

A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This manipulation of the argument ID causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS1.40% probability of exploitation · percentile 68.9% · 2026-06-19T12:03:05Z
Published2025-09-04
Last modified2025-09-29

Underlying weaknesses· 3

CWE-119CWE-121CWE-787

References

  1. https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.asp
  2. https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.asp#proof-of-concept-poc
  3. https://vuldb.com/?ctiid.322340
  4. https://vuldb.com/?id.322340
  5. https://vuldb.com/?submit.643446
  6. https://www.dlink.com/

3

TypeTargetConfidenceTier
WeaknessImproper Restriction of Operations within the Bounds of a Memory Buffercwe-1190%live
WeaknessStack-based Buffer Overflowcwe-1210%live
WeaknessOut-of-bounds Writecwe-7870%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-3538
CVE
CVE-2026-10206
CVE
CVE-2025-11408
CVE
CVE-2026-7854
CVE
CVE-2025-13188
CVE
CVE-2025-7908
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.