CVE-2025-1104
📋 TL;DR
This critical vulnerability in D-Link DHP-W310AV powerline adapters allows remote attackers to bypass authentication by spoofing. Attackers can gain unauthorized access to device management interfaces without valid credentials. Only users of DHP-W310AV version 1.04 are affected.
💻 Affected Systems
- D-Link DHP-W310AV
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network-connected devices, potential lateral movement to other systems, and unauthorized configuration changes to powerline adapters.
Likely Case
Unauthorized access to device management interface, potential network disruption, and exposure of network configuration details.
If Mitigated
Limited impact if devices are behind firewalls with restricted access and network segmentation is implemented.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub, making exploitation straightforward for attackers with basic knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
Check D-Link website for firmware updates. If no patch is available, implement workarounds immediately.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DHP-W310AV devices on separate VLANs or network segments to limit attack surface
Access Control Lists
allImplement firewall rules to restrict access to device management interfaces
🧯 If You Can't Patch
- Replace affected devices with non-vulnerable models or different vendors
- Disable remote management features and only allow local console access if possible
🔍 How to Verify
Check if Vulnerable:
Check device web interface or console for firmware version. If version is 1.04, device is vulnerable.Check Version:
Check device web interface at http://[device-ip]/ or use console connectionVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.04📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to device management interface
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual traffic patterns to device management ports (typically 80/443)
- Spoofed authentication requests
SIEM Query:
source_ip=* AND (dest_port=80 OR dest_port=443) AND dest_ip=[device-ip] AND (http_method=POST AND uri_contains="login")