CVE-2025-9938

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This manipulation of the argument ID causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121 CWE-787

Affected software

Vendor	Product	Versions
D-Link	DI-8400	16.07.26A1

References

https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.aspExploit, Third Party Advisory
https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.asp#proof-of-concept-pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.322340Permissions Required, VDB Entry
https://vuldb.com/?id.322340Third Party Advisory, VDB Entry
https://vuldb.com/?submit.643446Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Sep 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-99395.4A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of th CVE-2025-99405.4A vulnerability was detected in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /feature.php. Perf CVE-2025-99418.8A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing CVE-2025-99428.8A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.p CVE-2025-99439.1An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Servic CVE-2025-99444.3The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. CVE-2025-99454.3The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This CVE-2025-99466.1The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl CVE-2025-99474.9The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and includ CVE-2025-99484.3The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is du CVE-2025-99494.3The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. Thi CVE-2025-99504.9The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 vi