CVE-2025-7194

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in D-Link DI-500WF 17.04.10A1T. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file ip_position.asp of the component jhttpd. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-71956.4Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Opera CVE-2025-71969.8A vulnerability was found in code-projects Jonnys Liquor 1.0. It has been rated as critical. Affected by this issue is some unknown function CVE-2025-71979.8A vulnerability classified as critical has been found in code-projects Jonnys Liquor 1.0. This affects an unknown part of the file /admin/de CVE-2025-71989.8A vulnerability classified as critical was found in code-projects Jonnys Liquor 1.0. This vulnerability affects unknown code of the file /ad CVE-2025-71999.8A vulnerability, which was classified as critical, has been found in code-projects Library System 1.0. This issue affects some unknown proce CVE-2025-72009.8A vulnerability, which was classified as critical, was found in krishna9772 Pharmacy Management System up to a2efc8442931ec9308f3b4cf4778e57 CVE-2025-72025.1A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that re CVE-2025-72034.9The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore CVE-2025-72046.5In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user informat CVE-2025-72055.4The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes CVE-2025-72069.8A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the CVE-2025-72075.5A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrb