CVE-2025-71057
Published: 26 February 2026
Summary
CVE-2025-71057 is a high-severity Improper Authentication (CWE-287) vulnerability in D Link (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and AC-12 (Session Termination).
Deeper analysis
CVE-2025-71057, published on 2026-02-26, involves improper session management in the D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 running firmware ME_1.00. This vulnerability enables attackers to conduct a session hijacking attack by spoofing the IP address of an authenticated user. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) and maps to CWEs 287 (Improper Authentication), 345 (Insufficient Verification of Data Authenticity), and 384 (Session Fixation).
The vulnerability can be exploited over the network with low complexity by unauthenticated attackers requiring no user interaction. By spoofing the IP address of a legitimate authenticated user, attackers can hijack active sessions, achieving high integrity impacts such as unauthorized modifications to router configurations, while confidentiality impact remains low and availability is unaffected.
Mitigation guidance is available through D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, the vendor site at http://d-link.com, and a detailed disclosure repository on GitHub at https://github.com/theShinigami/CVE-Disclosures/tree/main/CVE-2025-71057.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208122
Vulnerability details
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing router web interface directly enables remote session hijacking via IP spoofing (T1563) after initial access through exploitation of the exposed application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 protects the authenticity of communications sessions, directly preventing session hijacking via IP spoofing by requiring secure session validation beyond source IP.
AC-12 enforces automatic session termination after defined conditions, reducing the time window available for attackers to exploit hijacked sessions.
IA-11 requires re-authentication for specific sensitive actions, blocking unauthorized modifications even if a session is hijacked through IP spoofing.