CVE-2025-2546

CWE-266CWE-284 — Improper Access Control4 documents4 sources
Severity
5.3MEDIUM
EPSS
0.8%
top 26.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
D-link Dir-605lD-link Dir-618Dlink Dir-605l Firmware+1 more
Timeline
PublishedMar 20
Latest updateApr 16

Description

A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formAdvFirewall of the component Firewall Service. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5d-link/dir-605l2.02, 3.02+1
▶CVEListV5d-link/dir-6182.02, 3.02+1

🔴Vulnerability Details

2
GHSA
GHSA-mqcq-x9x6-xrvj: A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2↗2025-03-20
▶
CVEList
D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access control↗2025-03-20
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS D-Link DIR-605L/DIR-618 Multiple Authentication Bypass URI Endpoints (CVE-2025-2546 - CVE-2025-2553)↗2025-04-16
▶