PT-2025-1265 · D Link · D-Link Dir-878

Wxhwxhwxh_Tutu · Published 2025-01-15 · Updated 2025-07-16 · CVE-2025-0481

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-878 version 1.03

Description A vulnerability has been found in the D-Link DIR-878, affecting an unknown function of the file /dllog.cgi of the component HTTP POST Request Handler. This issue leads to information disclosure and can be exploited remotely. The exploit has been disclosed to the public and may be used. The vulnerability is related to insufficient protection of service data, which may allow an attacker to gain unauthorized access to protected information.

Recommendations For D-Link DIR-878 version 1.03, consider disabling access to the /dllog.cgi file until a patch is available. Restrict access to the HTTP POST Request Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2025-00714

CVE-2025-0481

Affected Products

D-Link Dir-878

References · 13

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-878/dllog.md · Exploit
• https://bdu.fstec.ru/vul/2025-00714 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0481 · Security Note
• https://vuldb.com/?ctiid.291924 · Note
• https://vuldb.com/?submit.475011 · Note
• https://twitter.com/VulmonFeeds/status/1879743649979699566 · Twitter Post
• https://twitter.com/CVEnew/status/1879657478712914081 · Twitter Post
• https://t.me/cvenotify/107545 · Telegram Post
• https://vuldb.com/?id.291924 · Note
• https://t.me/cvedetector/15513 · Telegram Post
• https://t.me/cvenotify/129166 · Telegram Post
• https://dlink.com · Note