CVE-2025-2360

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2360
A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://lavender-bicycle-a5a.notion.site/D-Link-DIR-823G-SetUpnpSettings-1ac53a41781f80d1a290c8d5da3e795e?pvs=4 Exploit Third Party Advisory
https://vuldb.com/?ctiid.299827 Permissions Required VDB Entry
https://vuldb.com/?id.299827 Third Party Advisory VDB Entry
https://vuldb.com/?submit.513751 Third Party Advisory VDB Entry
https://www.dlink.com/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dir-823g_firmware:1.0.2b05_20181207:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-823g:-:*:*:*:*:*:*:*
History

15 Jul 2025, 16:49

Type Values Removed Values Added
References () https://lavender-bicycle-a5a.notion.site/D-Link-DIR-823G-SetUpnpSettings-1ac53a41781f80d1a290c8d5da3e795e?pvs=4 - () https://lavender-bicycle-a5a.notion.site/D-Link-DIR-823G-SetUpnpSettings-1ac53a41781f80d1a290c8d5da3e795e?pvs=4 - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.299827 - () https://vuldb.com/?ctiid.299827 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.299827 - () https://vuldb.com/?id.299827 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.513751 - () https://vuldb.com/?submit.513751 - Third Party Advisory, VDB Entry
References () https://www.dlink.com/ - () https://www.dlink.com/ - Product
First Time Dlink
Dlink dir-823g
Dlink dir-823g Firmware
CPE cpe:2.3:h:dlink:dir-823g:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-823g_firmware:1.0.2b05_20181207:*:*:*:*:*:*:*
Summary
  • (es) Se encontró una vulnerabilidad clasificada como crítica en D-Link DIR-823G 1.0.2B05_20181207. Esta vulnerabilidad afecta a la función SetUpnpSettings del archivo /HNAP1/ del componente UPnP Service. La manipulación del argumento SOAPAction provoca una autorización incorrecta. El ataque puede ejecutarse remotamente. El exploit se ha divulgado públicamente y puede utilizarse. Esta vulnerabilidad solo afecta a los productos que ya no reciben soporte del fabricante.

17 Mar 2025, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-17 04:15

Updated : 2025-07-15 16:49

NVD link : CVE-2025-2360

Mitre link : CVE-2025-2360

CVE.ORG link : CVE-2025-2360

JSON object : View

Products Affected

dlink

  • dir-823g_firmware
  • dir-823g
CWE
CWE-266

Incorrect Privilege Assignment

CWE-285

Improper Authorization