CVE-2025-14528
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-803_firmware | to 1.04 (inc) |
| dlink | dir-803 | a1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the /getcfg.php endpoint on D-Link DIR-803 routers responds to unauthorized requests manipulating the AUTHORIZED_GROUP parameter. One detection method is to send an HTTP request to the router's /getcfg.php endpoint with the parameter AUTHORIZED_GROUP set to a crafted value (e.g., AUTHORIZED_GROUP=1%0a) and observe if sensitive configuration data is returned. Additionally, attackers use Google dorking with queries like 'inurl:getcfg.php' to identify vulnerable devices. A sample curl command to test might be: curl -v 'http://<router-ip>/getcfg.php?AUTHORIZED_GROUP=1%0a' - this may return sensitive configuration XML if the device is vulnerable. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing restrictive firewall rules to block remote access to the /getcfg.php endpoint on the affected D-Link DIR-803 routers. Since the product is no longer supported by the vendor and no firmware patch is available, network-level protections such as blocking inbound traffic to this endpoint or isolating the device from untrusted networks are recommended to prevent exploitation. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability leads to unauthorized disclosure of sensitive configuration information, including administrator credentials, which can compromise confidentiality. Such information disclosure can result in non-compliance with data protection standards and regulations like GDPR and HIPAA that require safeguarding sensitive data and ensuring confidentiality. Therefore, exploitation of this vulnerability could negatively impact compliance with these regulations by exposing protected information. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the /getcfg.php endpoint on D-Link DIR-803 routers responds to unauthorized requests manipulating the AUTHORIZED_GROUP parameter. One detection method is to send an HTTP request to the router's /getcfg.php with the parameter SERVICES=DEVICE.ACCOUNT and AUTHORIZED_GROUP=1%0a (newline character) and observe if the router returns sensitive configuration data. Additionally, attackers use Google dorking with queries like 'inurl:getcfg.php' to find vulnerable devices. A sample curl command to test might be: curl -v 'http://<router-ip>/getcfg.php?SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a' and check if sensitive XML configuration data is returned. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing restrictive firewall rules to block external access to the /getcfg.php endpoint on the affected D-Link DIR-803 routers. Since the product is no longer supported by the vendor and no patch is available, preventing remote access to this vulnerable interface is critical. Network administrators should restrict access to trusted internal networks only and consider isolating or replacing the affected devices to prevent exploitation. [2]
Can you explain this vulnerability to me?
This vulnerability exists in the D-Link DIR-803 router up to firmware version 1.04, specifically in the /getcfg.php file within the Configuration Handler component. By manipulating the AUTHORIZED_GROUP argument, an attacker can remotely cause information disclosure. The exact function affected is unknown, but the vulnerability allows unauthorized access to sensitive information.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information from the affected device. Since the attack can be performed remotely without authentication, it poses a risk of exposing confidential configuration data or other sensitive details, potentially compromising the security of the network or device.