Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-34048: D-Link DSL Routers: Unauthenticated File Access via Crafted Web Request

CVE-2025-34048 · published 1 year ago

Summary

Certain D-Link DSL routers have a security flaw that allows an attacker to access files on the device without permission. This could potentially allow an attacker to view sensitive information or disrupt the router's function. Update the firmware to the latest version to fix this issue.

Original advisory text

A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.7 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published26 Jun 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-34048 · NVD

Track software like this

Free during beta