CVE-2018-25358: d-link dir-601

Vulnerability summary

CVE-2018-25358 is a high (CVSS 8.7) vulnerability in d-link dir-601. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-05-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST requests. Attackers can send requests to /my_cgi.cgi with table_name values like admin_user, wireless_settings, and wireless_security to extract administrative credentials and wireless network keys in clear text.

• CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.