cbcvebase.
CVE-2025-2360
published 2025-03-17

CVE-2025-2360: A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the…

PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.77%
88.7th percentile
A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdir-823g——
dlinkdir-823g_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/HNAP1/↗
otherSOAPAction: "http://purenetworks.com/HNAP1/Set(DDNSSettings|UpnpSettings)"
  • →Target POST requests to /HNAP1/ (exact 7-byte URI) with a SOAPAction header referencing purenetworks.com/HNAP1/SetDDNSSettings or purenetworks.com/HNAP1/SetUpnpSettings — the absence of a Cookie header is a key indicator of authentication bypass.
  • →The request body must contain a <Set(DDNSSettings|UpnpSettings) element (space after the tag name), confirming the SOAP payload targets the vulnerable SetDDNSSettings or SetUpnpSettings functions.
  • →The vulnerability is exploitable remotely without authentication via manipulation of the SOAPAction argument in the UPnP Service endpoint /HNAP1/ on D-Link DIR-823G 1.0.2B05_20181207. ↗
  • →Exploit is publicly disclosed; treat any matching traffic as high-confidence exploitation attempt (Emerging Threats classifies this as Major severity, High confidence). ↗
  • ·This vulnerability only affects D-Link DIR-823G firmware version 1.0.2B05_20181207, which is end-of-life and will not receive patches from the vendor. ↗
  • ·The Snort/Suricata rule (sid:2061622) covers both CVE-2025-2359 (SetDDNSSettings) and CVE-2025-2360 (SetUpnpSettings) simultaneously; tune or split the rule if per-CVE alerting granularity is required.
  • ·The rule is scoped to plaintext traffic only (tls_state plaintext); encrypted HNAP traffic will not be detected by this signature.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.