PT-2025-50639 · D Link · Dir-803

Jiahui2888 · Published 2025-12-11 · Updated 2026-02-23 · CVE-2025-14528

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-803 versions prior to 1.05

Description A flaw exists in D-Link DIR-803, potentially leading to information disclosure. The issue resides within the Configuration Handler component, specifically in the /getcfg.php file. Manipulation of the AUTHORIZED GROUP argument can trigger the flaw. The attack can be carried out remotely. The exploit is publicly available. This vulnerability affects products that are no longer supported.

Recommendations Update to version 1.05 or later. As a temporary workaround, restrict access to the /getcfg.php file.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-14528

Affected Products

Dir-803

References · 12

• 🔥 https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-2/DIR-803%20Authentication%20Bypass.md#poc · Exploit
• 🔥 https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-2/DIR-803%20Authentication%20Bypass.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14528 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14528 · Vendor Advisory
• https://vuldb.com/?id.335869 · Note
• https://vuldb.com/?ctiid.335869 · Note
• https://t.me/CVEtracker/39505 · Telegram Post
• https://twitter.com/CVEnew/status/1999876887942668719 · Twitter Post
• https://dlink.com · Note
• https://t.me/cveNotify/145812 · Telegram Post
• https://twitter.com/Crowd_Security/status/2025931746366124326 · Twitter Post
• https://vuldb.com/?submit.703150 · Note