CVE-2025-2553: d-link dir-605l_firmware Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-2553 is a medium (CVSS 5.3) Incorrect Privilege Assignment vulnerability in d-link dir-605l_firmware. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.