PT-2025-21871 · D Link · D-Link Di-7003Gv2

153528990 · Published 2025-05-18 · Updated 2025-05-19 · CVE-2025-4903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R(68125)

Description: A critical issue was found, affecting the function sub 41F4F0 of the file "/H5/webgl.asp?tggl port=0&remote management=0&http passwd=game&exec service=admin-restart". This leads to an unverified password change. The attack can be initiated remotely.

Recommendations: For D-Link DI-7003GV2 version 24.04.18D1 R(68125), as a temporary workaround, consider disabling the sub 41F4F0 function until a patch is available. Restrict access to the "/H5/webgl.asp" endpoint to minimize the risk of exploitation. Avoid using the http passwd and exec service parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

CWE-620

Related Identifiers

BDU:2025-05866

CVE-2025-4903

Affected Products

D-Link Di-7003Gv2

References · 11

• 🔥 https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/webgl_asp.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4903 · Security Note
• https://bdu.fstec.ru/vul/2025-05866 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4903 · Vendor Advisory
• https://twitter.com/CVEnew/status/1924298496867471710 · Twitter Post
• https://vuldb.com/?id.309459 · Note
• https://t.me/cvenotify/122840 · Telegram Post
• https://vuldb.com/?submit.578051 · Note
• https://vuldb.com/?ctiid.309459 · Note
• https://dlink.com · Note
• https://t.me/cvetracker/24178 · Telegram Post