Cyber Posture

CVE-2025-2548

MediumPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
15 July 2025
KEV Added
Patch
CVSS Score 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0039 60.2th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2548 is a problematic vulnerability involving improper access controls (CWE-266, CWE-284) in an unknown function of the /goform/formSetDomainFilter file on D-Link DIR-618 and DIR-605L routers running firmware versions 2.02 and 3.02. Published on 2025-03-20, it carries a CVSS v3.1 base score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

An attacker positioned on the adjacent local network can exploit this vulnerability with low complexity, requiring no privileges or user interaction. Exploitation enables limited integrity impacts, such as unauthorized modifications due to the improper access controls, but does not affect confidentiality or availability.

Advisories note that the affected products are no longer supported by the maintainer, with no patches available. The exploit has been publicly disclosed and may be used, as detailed in references including VulDB entries and Notion site postings.

Details

CWE(s)
CWE-266CWE-284

Affected Products

dlink
dir-618 firmware
2.02
dlink
dir-605l firmware
3.02

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability allows unauthenticated modification of router configuration via a web form due to improper access controls, directly enabling exploitation of the network device's application interface from an adjacent network.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References