CVE-2025-29514
Published: 25 August 2025
Summary
CVE-2025-29514 is a critical-severity Improper Access Control (CWE-284) vulnerability in Dlink Dsl-7740C Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to block unauthorized crafted web requests to the config.xgi endpoint.
Ensures the config.xgi function requires appropriate privileges, preventing unauthenticated access to sensitive configuration data.
Limits and authorizes only safe actions without identification or authentication, excluding config file downloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exploitation of public-facing router web endpoint (config.xgi) for unauthorized config file access.
NVD Description
Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration file via providing a crafted web request.
Deeper analysisAI
CVE-2025-29514, published on 2025-08-25, is an incorrect access control vulnerability (CWE-284) in the config.xgi function of the D-Link DSL-7740C router with firmware version DSL7740C.V6.TR069.20211230. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue stems from inadequate protections that permit unauthorized access to sensitive device data.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By sending a crafted web request to the config.xgi endpoint, they can download the router's configuration file, which may contain credentials, network settings, and other sensitive information, leading to high impacts on confidentiality, integrity, and availability.
D-Link addresses the vulnerability in their security bulletin at https://www.dlink.com/en/security-bulletin/. A proof-of-concept exploit is detailed in a GitHub gist at https://gist.github.com/stevenyu113228/1fc5dcc63e4b4e9f5523167be11abf17.
Details
- CWE(s)