CVE-2025-2360
📋 TL;DR
A critical vulnerability in D-Link DIR-823G routers allows remote attackers to bypass authorization controls via manipulation of the SOAPAction parameter in the UPnP service. This affects D-Link DIR-823G routers running firmware version 1.0.2B05_20181207. The vulnerability is particularly dangerous as these devices are no longer supported by the manufacturer.
💻 Affected Systems
- D-Link DIR-823G
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains administrative access to router, enabling network takeover, traffic interception, malware deployment, and lateral movement into connected networks.
Likely Case
Remote attacker modifies router configuration, changes DNS settings, redirects traffic, or disables security features.
If Mitigated
Attack prevented through network segmentation, firewall rules, or device replacement.
🎯 Exploit Status
Exploit details have been publicly disclosed. Attack requires sending specially crafted SOAP requests to the UPnP service endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace affected devices with supported models.
🔧 Temporary Workarounds
Disable UPnP Service
allTurn off UPnP functionality in router settings to prevent exploitation via this service.
Access router admin interface > Advanced > UPnP > Disable
Block External UPnP Access
linuxConfigure firewall to block external access to UPnP service (port 1900/udp and related ports).
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 1900 -j DROP
🧯 If You Can't Patch
- Replace affected D-Link DIR-823G routers with currently supported models from any vendor.
- Segment affected routers into isolated network zones with strict firewall rules limiting their communication.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.0.2B05_20181207 and UPnP is enabled, device is vulnerable.Check Version:
Check router web interface or use: curl -s http://router-ip/HNAP1/ | grep -i versionVerify Fix Applied:
Verify UPnP is disabled in router settings and test that UPnP service does not respond to external requests.📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests to /HNAP1/ endpoint
- Multiple failed authentication attempts followed by successful UPnP configuration changes
- Router configuration changes from unexpected IP addresses
Network Indicators:
- Unusual traffic to router port 1900/udp from external sources
- SOAP requests with manipulated SOAPAction headers
- UPnP discovery requests from suspicious IPs
SIEM Query:
source="router-logs" AND (uri="/HNAP1/" OR protocol="UPnP") AND (status="200" OR action="SetUpnpSettings")