CVE-2025-2550: d-link dir-605l_firmware Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-2550 is a medium (CVSS 5.3) Incorrect Privilege Assignment vulnerability in d-link dir-605l_firmware. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/formSetDDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.