PT-2025-26164 · D Link · D-Link Dph-400S/Se Voip Phone

Shaunak Ganorkar

·

Published

2025-06-11

·

Updated

2025-07-22

·

CVE-2025-45784

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions D-Link DPH-400S/SE VoIP Phone version 1.01
Description The issue concerns hardcoded provisioning variables in the firmware, including PROVIS USER PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools, potentially leading to unauthorized access to device functions or user accounts. This is due to insecure storage of sensitive information in the firmware binary.
Recommendations For D-Link DPH-400S/SE VoIP Phone version 1.01, consider restricting access to the device's firmware and provisioning variables to minimize the risk of exploitation. As a temporary workaround, avoid using the PROVIS USER PASSWORD variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Using Hardcoded Credentials

Weakness Enumeration

CWE-532CWE-798

Related Identifiers

BDU:2025-09335
CVE-2025-45784

Affected Products

D-Link Dph-400S/Se Voip Phone