Cyber Resilience

CVE-2025-1104

Auth Bypass in Dlink Dhp-W310Av Firmware 1.04

Public PoCAuth Bypass
Published
07 February 2025
Modified
21 May 2025
Patch / advisory
View advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.029 86th percentile
Risk Priority 46 floored blend · peak EPSS

Summary

CVE-2025-1104 is a medium-severity Improper Authentication (CWE-287) vulnerability in Dlink Dhp-W310Av Firmware. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 14% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability classified as critical has been identified in the D-Link DHP-W310AV firmware version 1.04. It stems from improper authentication handling that permits authentication bypass through spoofing, as indicated by the associated CWEs 287 and 290. The flaw resides in an unspecified code component and carries a CVSS 4.0 score of 6.9, reflecting network-accessible attack conditions with low complexity and no required privileges or user interaction.

Remote, unauthenticated attackers can exploit the issue by sending crafted requests that spoof valid credentials or sessions, resulting in partial compromise of confidentiality, integrity, and availability on the affected device. Publicly available proof-of-concept material demonstrates that the bypass can be triggered without physical access or prior authentication.

The EPSS score for this CVE rose from a low baseline of 0.0006 to a peak of 0.0104, indicating that exploitation interest increased after public disclosure. The availability of exploit details on public repositories further suggests that practitioners should monitor for follow-on activity targeting this D-Link model.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to the public…

more

and may be used.

CWE(s)
CWE-287CWE-290

Related Threats

MITRE ATT&CK Enterprise Techniques

T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1557.001 Name Resolution Poisoning and SMB Relay Credential Access
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1036.001 Invalid Code Signature Stealth
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-30061Same vendor: Dlink
CVE-2017-9100Same vendor: Dlink
CVE-2025-44083Same vendor: Dlink
CVE-2023-32222Same vendor: Dlink
CVE-2024-33110Same vendor: Dlink
CVE-2024-57045Same vendor: Dlink
CVE-2025-4755Same vendor: Dlink
CVE-2023-30063Same vendor: Dlink
CVE-2020-8863Same vendor: Dlink
CVE-2019-13372Same vendor: Dlink

Affected Assets

dlink
dhp-w310av firmware
1.04

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 11 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.4
  • V6.5.4
  • V6.5.5
  • V6.5.7

Mitigating Controls (NIST 800-53 r5) AI

IA-2 Identification and Authentication (Organizational Users) good match

Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.

IA-3 Device Identification and Authentication good match

Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.

IA-8 Identification and Authentication (Non-organizational Users) good match

Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.

IA-5 Authenticator Management good match

Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.

AC-3 Access Enforcement partial match

Enforces access only after approved authorizations, which presupposes correct authentication has occurred.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

PR.AA-03 mostly match
prevents

PR.AA-03 directly enforces authentication mechanisms that eliminate most improper-authentication defects, yet CWE-287 spans additional vectors (missing checks, flawed protocols, session handling) that one control does not fully close.

PR.AA-01 partial match
prevents

PR.AA-01 supplies and governs credentials/tokens that authentication relies on, removing some weak-credential cases, yet leaves verification logic, missing checks, and protocol flaws untouched.

PR.AA-02 partial match
prevents

PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.

PR.PS-01 partial match
prevents

PR.PS-01 can enforce auth-related settings via hardened baselines and default reviews, blocking some config-based instances of CWE-287, yet leaves code-level auth flaws untouched so neither direction reaches mostly.

PR.PS-02 partial match
prevents

Patching/maintenance can remediate some known auth vulnerabilities after deployment (partial forward) but does not address the design or implementation of authentication logic itself (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
prevents

Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.

A.5.17 Authentication information mostly match
prevents

Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect spoofing vulnerabilities but does not prevent them by itself.

A.5.15 Access control partial match
prevents

Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.

A.5.16 Identity management partial match
prevents

Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.

A.5.18 Access rights partial match
prevents

Access rights assignment limits exposure but does not enforce authentication strength.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-287, CWE-290
RHEL 7 (3 rules)
  • V-204425 The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password. prevents CWE-287
  • V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-287, CWE-290
  • V-204424 The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. prevents CWE-287
RHEL 8 (1 rule)
  • V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-287, CWE-290
Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
Ubuntu 24.04 (2 rules)
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
  • V-270714 Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. prevents CWE-287

References