CVE-2025-26238: n/a

This vulnerability affects D-Link DI-8100G version 17.12.20. The flaw lies in the handling of the 'flag' parameter within the msp_info functionality, allowing an attacker to execute arbitrary code remotely with no privileges and no user interaction required. The CVSS v3.1 score is 8.1, indicating high severity, with attack vector being adjacent network, low attack complexity, and no privileges required. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker on an adjacent network to execute arbitrary code on the affected device, compromising confidentiality and integrity. There is no impact on availability reported. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation in local network environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device from untrusted networks and monitor for unusual activity related to the msp_info functionality. Avoid exposing the device to adjacent network attackers.