CVE-2025-2551
📋 TL;DR
This vulnerability in D-Link DIR-618 and DIR-605L routers allows attackers with local network access to bypass access controls via the /goform/formSetPortTr endpoint. It affects users of these specific router models running vulnerable firmware versions. Since these products are no longer supported by the manufacturer, users cannot receive official patches.
💻 Affected Systems
- D-Link DIR-618
- D-Link DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker on the local network could reconfigure router settings, potentially enabling further attacks or disrupting network connectivity.
Likely Case
Local network users could modify port forwarding or other router configurations without proper authorization.
If Mitigated
With proper network segmentation and access controls, the impact is limited to the local network segment containing the router.
🎯 Exploit Status
Exploit requires local network access but is simple to execute with published details. Attackers need to reach the router's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as products are end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the vulnerable routers on separate VLANs to limit exposure
Access Control Lists
allImplement network ACLs to restrict access to router management interface
🧯 If You Can't Patch
- Replace affected routers with supported models from any vendor
- Implement strict network segmentation to isolate vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via web interface at 192.168.0.1 or 192.168.1.1Check Version:
Access router web interface and check System Status or Firmware InformationVerify Fix Applied:
Verify router has been replaced with supported hardware or isolated from critical networks📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formSetPortTr
- Multiple failed authentication attempts followed by configuration changes
Network Indicators:
- Unexpected traffic to router management interface from unauthorized IPs
- Changes to port forwarding rules without administrative action
SIEM Query:
source_ip IN (local_network_range) AND dest_ip=router_ip AND uri_path="/goform/formSetPortTr" AND http_method="POST"🔗 References
- https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPortTr-1b153a41781f809d95c8e39c6c31c348?pvs=4
- https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPortTr-1b053a41781f8000a9ded17aa2f587cc?pvs=4
- https://vuldb.com/?ctiid.300165
- https://vuldb.com/?id.300165
- https://vuldb.com/?submit.516793
- https://www.dlink.com/
