CVE-2025-2549
📋 TL;DR
This CVE describes an improper access control vulnerability in D-Link DIR-618 and DIR-605L routers affecting the /goform/formSetPassword endpoint. Attackers on the local network can exploit this to bypass authentication controls. Only unsupported legacy devices are affected.
💻 Affected Systems
- D-Link DIR-618
- D-Link DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized administrative access to router configuration, potentially enabling network traffic interception, DNS hijacking, or further network compromise.
Likely Case
Local attacker modifies router settings like passwords or network configurations, causing service disruption or enabling man-in-the-middle attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated network segments containing only legacy devices.
🎯 Exploit Status
Public exploit details available in references. Simple HTTP request manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as products are end-of-life. Replace affected devices with supported models.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers in separate VLANs to limit attack surface
Access Control Lists
allImplement network ACLs to restrict access to router management interfaces
🧯 If You Can't Patch
- Replace affected routers with supported models that receive security updates
- Implement strict network segmentation to isolate legacy devices from critical systems
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via web interface or SSH. If DIR-618/DIR-605L with version 2.02 or 3.02, device is vulnerable.Check Version:
Check router web interface at http://[router-ip]/ or use telnet/SSH if enabledVerify Fix Applied:
No fix available. Verification requires device replacement with supported model.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formSetPassword
- Multiple failed authentication attempts followed by successful password changes
Network Indicators:
- HTTP traffic to router management interface from unexpected internal IPs
- Unusual configuration changes to router settings
SIEM Query:
source_ip=INTERNAL_NET dest_ip=ROUTER_IP uri_path="/goform/formSetPassword" method=POST🔗 References
- https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPassword-1b153a41781f803d8166f9b551b30cd4?pvs=4
- https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPassword-1b053a41781f8021b704f7dfeb1fcd09?pvs=4
- https://vuldb.com/?ctiid.300163
- https://vuldb.com/?id.300163
- https://vuldb.com/?submit.516791
- https://www.dlink.com/
