Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-2360 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Dlink Dir-823G Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2360 is a critical improper authorization vulnerability (CWE-266, CWE-285) in the D-Link DIR-823G router running firmware version 1.0.2B05_20181207. The issue resides in the SetUpnpSettings function exposed via the /HNAP1/ endpoint of the UPnP Service, where manipulation of the SOAPAction argument bypasses authorization checks. This flaw carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and exclusively impacts products that are no longer supported by the vendor.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation grants improper authorization, potentially allowing limited disruption to confidentiality, integrity, and availability, such as unauthorized modifications to UPnP settings or service alterations.
Advisories from VulDB and related disclosures, including a public exploit proof-of-concept on a Notion site, confirm no patches are available, as the affected D-Link DIR-823G models are end-of-support. Security practitioners should isolate or decommission these devices, apply network segmentation to block /HNAP1/ access, and monitor for anomalous UPnP traffic.
The exploit has been publicly disclosed and may be actively used against exposed instances, underscoring risks for legacy Internet-facing routers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6460
Vulnerability Data
A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack…
more
can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 14 hardening rules · 7 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Mandates that access-control decisions are made and applied to each request before access occurs.
Requires a tamperproof, always-invoked reference monitor that performs authorization checks.
Directly requires enforcement of approved authorizations for every access request, stopping improper or missing checks.
Least privilege directly requires that only the minimal necessary privileges are assigned to each actor.
Account management defines and authorizes the exact privileges granted to each account or role.
Separation of duties constrains which privilege combinations may be assigned to any actor.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Secure SDLC practices catch and eliminate most authorization defects before release, yet a single broad outcome cannot address every design, role, and runtime facet of CWE-285.
PR.AA-01 supplies managed identities and access-request workflows that can support downstream authorization decisions, yet does nothing to enforce or verify authorization checks inside a product, leaving CWE-285 fully unaddressed by this control alone.
Network segmentation/zero-trust limits external reachability (partial prevention of exploitation) but leaves application-level authorization logic untouched, so the CWE remains fully introducible and only one facet of its risk is addressed.
PR.PS-05 blocks unauthorized binaries/DNS while CWE-285 is an in-product authorization-check defect, so the control neither prevents the weakness nor removes any of its risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Granular, policy-driven assignment of permissions and dynamic enforcement of those permissions prevent the incorrect or missing authorization decisions that lead to improper authorization flaws.
By requiring documented authorization rules and periodic policy reviews, the control makes it less likely that authorization decisions will be omitted or implemented inconsistently across applications.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-252656 The OL 8 operating system must not be configured to bypass password requirements for privilege escalation. prevents CWE-285
- V-248551 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
- V-248581 OL 8 must require users to provide a password for privilege escalation. prevents CWE-285
Oracle Linux 9 (1 rule)
- V-271779 OL 9 must be configured so that a sticky bit must be set on all public directories. prevents CWE-266
RHEL 7 (3 rules)
- V-204429 The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation. prevents CWE-285
- V-204430 The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation. prevents CWE-285
- V-251704 The Red Hat Enterprise Linux operating system must not be configured to bypass password requirements for privilege escalation. prevents CWE-285
RHEL 8 (2 rules)
- V-230243 A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
- V-251712 The RHEL 8 operating system must not be configured to bypass password requirements for privilege escalation. prevents CWE-285
RHEL 9 (1 rule)
- V-257929 A sticky bit must be set on all RHEL 9 public directories. prevents CWE-266
Ubuntu 22.04 (2 rules)
- V-260513 Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-266
Ubuntu 24.04 (2 rules)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-266
- V-270750 Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266