CVE-2025-2547: d-link dir-605l_firmware Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-2547 is a medium (CVSS 5.3) Incorrect Privilege Assignment vulnerability in d-link dir-605l_firmware. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.