CVE-2025-52079
Published: 21 October 2025
Summary
CVE-2025-52079 is a high-severity Improper Access Control (CWE-284) vulnerability in Dlink Dir-820L Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations for logical access to the password change endpoint, directly preventing improper access control exploitation.
IA-5 mandates secure management and protection of authenticators like the administrator password against unauthorized modification.
SI-10 validates inputs to the /get_set.ccp endpoint, blocking crafted POST requests that enable unverified password changes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unverified admin password change via crafted POST to web management interface (/get_set.ccp), facilitating exploitation of public-facing applications/remote services, account manipulation, and modification of network device authentication.
NVD Description
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.
Deeper analysisAI
CVE-2025-52079 is an improper access control vulnerability in the administrator password setting of the D-Link DIR-820L router running firmware version 1.06B02. It allows unverified password changes via a crafted POST request to the /get_set.ccp endpoint. Published on 2025-10-21T20:20:40.347, the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-284.
The vulnerability can be exploited by an attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation enables changing the administrator password without verification, granting high-impact access to confidentiality, integrity, and availability, which could result in full router compromise.
Mitigation guidance is available in advisories referenced at https://www.dlink.com/en/security-bulletin/ and a GitHub repository at https://github.com/namberino/cve/tree/main/CVE-2025-52079.
Details
- CWE(s)