CVE-2025-2548
Published: 20 March 2025
Summary
CVE-2025-2548 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Dlink Dir-618 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-2548 is a problematic vulnerability involving improper access controls (CWE-266, CWE-284) in an unknown function of the /goform/formSetDomainFilter file on D-Link DIR-618 and DIR-605L routers running firmware versions 2.02 and 3.02. Published on 2025-03-20, it carries a CVSS v3.1 base score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
An attacker positioned on the adjacent local network can exploit this vulnerability with low complexity, requiring no privileges or user interaction. Exploitation enables limited integrity impacts, such as unauthorized modifications due to the improper access controls, but does not affect confidentiality or availability.
Advisories note that the affected products are no longer supported by the maintainer, with no patches available. The exploit has been publicly disclosed and may be used, as detailed in references including VulDB entries and Notion site postings.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7165
Vulnerability details
A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/formSetDomainFilter. The manipulation leads to improper access controls. The attack can only be initiated within the local…
more
network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated modification of router configuration via a web form due to improper access controls, directly enabling exploitation of the network device's application interface from an adjacent network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of approved access authorizations, comprehensively addressing the improper access controls in the /goform/formSetDomainFilter function.
Prohibits use of unsupported system components like the end-of-life D-Link routers, eliminating exposure to this unpatchable vulnerability.
Enforces least privilege to ensure only authorized access to system functions, mitigating unauthorized modifications enabled by the flaw.