CVE-2025-4749
📋 TL;DR
A critical vulnerability in D-Link DI-7003GV2 routers allows remote attackers to trigger a denial of service via the factory reset handler. This affects organizations using these routers, potentially disrupting network operations. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- D-Link DI-7003GV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router outage requiring physical reset, disrupting all network services for connected devices.
Likely Case
Router becomes unresponsive, requiring manual reboot and causing temporary network downtime.
If Mitigated
Minimal impact if routers are behind firewalls with restricted WAN access.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
Check D-Link website for firmware updates. If available, download and apply through router admin interface.
🔧 Temporary Workarounds
Block Access to Backup Endpoint
allRestrict network access to the vulnerable /H5/backup.asp endpoint using firewall rules.
Disable Remote Management
allTurn off remote administration features to prevent external exploitation.
🧯 If You Can't Patch
- Segment network to isolate routers from untrusted networks
- Implement strict firewall rules blocking all WAN access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 24.04.18D1 R(68125), it is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware section.Verify Fix Applied:
Verify firmware version has changed from vulnerable version after update.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /H5/backup.asp?opt=reset
- Router reboot events in logs
Network Indicators:
- Unusual traffic patterns to router management port
- Router becoming unresponsive to pings
SIEM Query:
source="router_logs" AND (uri="/H5/backup.asp?opt=reset" OR event="reboot")