CVE-2025-2548
Published: 20 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-2548 is a problematic vulnerability involving improper access controls (CWE-266, CWE-284) in an unknown function of the /goform/formSetDomainFilter file on D-Link DIR-618 and DIR-605L routers running firmware versions 2.02 and 3.02. Published on 2025-03-20, it carries a CVSS v3.1 base score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
An attacker positioned on the adjacent local network can exploit this vulnerability with low complexity, requiring no privileges or user interaction. Exploitation enables limited integrity impacts, such as unauthorized modifications due to the improper access controls, but does not affect confidentiality or availability.
Advisories note that the affected products are no longer supported by the maintainer, with no patches available. The exploit has been publicly disclosed and may be used, as detailed in references including VulDB entries and Notion site postings.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows unauthenticated modification of router configuration via a web form due to improper access controls, directly enabling exploitation of the network device's application interface from an adjacent network.