PT-2025-42896 · D Link · D-Link Dsr-150+2

Published 2025-10-21 · Updated 2026-02-27 · CVE-2025-60344

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSR-150 D-Link DSR-150N D-Link DSR-250N version 1.09B32 WW

Description An unauthenticated Local File Inclusion (LFI) exists in D-Link DSR series routers. This allows remote attackers to retrieve sensitive configuration files in clear text. These files contain administrative credentials and VPN settings, potentially granting full administrative access to the router.

Recommendations Update D-Link DSR-150 to a newer version. Update D-Link DSR-150N to a newer version. Update D-Link DSR-250N to a newer version than 1.09B32 WW.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Information Disclosure

Weakness Enumeration

CWE-284

CWE-266

CWE-200

CWE-24

Related Identifiers

BDU:2025-14651

CVE-2025-60344

Affected Products

D-Link Dsr-150

D-Link Dsr-150N

D-Link Dsr-250

References · 9

• 🔥 https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344 · Exploit
• https://bdu.fstec.ru/vul/2025-14651 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60344 · Security Note
• https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability · Note
• https://t.me/cveNotify/153552 · Telegram Post
• https://t.me/CVEtracker/35404 · Telegram Post
• https://t.me/cveNotify/153543 · Telegram Post
• https://vuldb.com/?id.329223 · Note
• https://t.me/cveNotify/139635 · Telegram Post