CVE-2025-2553
published 2025-03-20CVE-2025-2553: A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file…
PriorityP423medium4.3CVSS 3.1
AVAACLPRNUINSUCNILAN
EPSS
1.14%
63.1th percentile
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-605l | — | — |
| d-link | dir-605l | — | — |
| d-link | dir-618 | — | — |
| d-link | dir-618 | — | — |
| dlink | dir-605l_firmware | — | — |
| dlink | dir-618_firmware | — | — |
| msrc | cbl2_booth_1.0-8_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:N/I:P/A:N
vendor_msrc6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9fcc-m4p7-2rp9: A vulnerability was found in D-Link DIR-618 and DIR-605L 2
ghsa_unreviewed·2025-03-20
CVE-2025-2553 [MEDIUM] CWE-266 GHSA-9fcc-m4p7-2rp9: A vulnerability was found in D-Link DIR-618 and DIR-605L 2
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Microsoft
The authfile directive in the booth config file is ignored preventing use of authentication in communications from node to node. As a result nodes that do not have the correct authentication key are n
vendor_msrc·2022-07-12·CVSS 6.5
CVE-2022-2553 [MEDIUM] CWE-287 The authfile directive in the booth config file is ignored preventing use of authentication in communications from node to node. As a result nodes that do not have the correct authentication key are n
The authfile directive in the booth config file is ignored preventing use of authentication in communications from node to node. As a result nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If
Suricata
ET WEB_SPECIFIC_APPS D-Link DIR-605L/DIR-618 Multiple Authentication Bypass URI Endpoints (CVE-2025-2546 - CVE-2025-2553)
suricata·2025-04-16·CVSS 5.3
CVE-2025-2546 [MEDIUM] ET WEB_SPECIFIC_APPS D-Link DIR-605L/DIR-618 Multiple Authentication Bypass URI Endpoints (CVE-2025-2546 - CVE-2025-2553)
ET WEB_SPECIFIC_APPS D-Link DIR-605L/DIR-618 Multiple Authentication Bypass URI Endpoints (CVE-2025-2546 - CVE-2025-2553)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DIR-605L/DIR-618 Multiple Authentication Bypass URI Endpoints (CVE-2025-2546 - CVE-2025-2553)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/form"; fast_pattern; startswith; pcre:"/^(?:AdvFirewall|AdvNetwork|SetDDNS|SetDomainFilter|SetPassword|SetPortTr|TcpipSetup|VirtualServ)/R"; http.header_names; to_lowercase; content:!"|0d 0a|cookie|0d 0a|"; reference:cve,2025-2546; reference:cve,2025-2547; reference:cve,2025-2548; reference:cve,2025-2549; reference:cve,2025-2550; reference:cve,2025-2551; reference:cve,2025-2552; reference:cve,2025-2553; reference:url,
No public exploits indexed.
No writeups or analysis indexed.
https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formVirtualServ-1b153a41781f80b98645c3f7f4c5f4ae?pvs=4https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formVirtualServ-1b053a41781f80b28443daabf03c0825?pvs=4https://vuldb.com/?ctiid.300167https://vuldb.com/?id.300167https://vuldb.com/?submit.516795https://www.dlink.com/
2025-03-20
Published