CVE-2025-4901
📋 TL;DR
This vulnerability in D-Link DI-7003GV2 routers allows attackers on the local network to access sensitive information through the HTTP endpoint. The information disclosure could expose system state or configuration details that should not be publicly accessible. Only devices on firmware version 24.04.18D1 R(68125) are affected.
💻 Affected Systems
- D-Link DI-7003GV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain sensitive router configuration details, network topology information, or credentials that could be used for further attacks within the network.
Likely Case
Local network attackers can access system state information that reveals details about the router's configuration and potentially identify other vulnerabilities.
If Mitigated
With proper network segmentation and access controls, the impact is limited to information that doesn't enable privilege escalation or remote access.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires local network access but no authentication. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
Check D-Link's official website for firmware updates. If available, download the latest firmware and apply through the router's web interface under System Tools > Firmware Update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the router management interface to a dedicated VLAN or restrict access to trusted management hosts only.
Access Control Lists
allImplement firewall rules to restrict access to the router's web interface from unauthorized internal IP addresses.
🧯 If You Can't Patch
- Implement strict network segmentation to limit which devices can access the router's management interface
- Monitor network traffic to the router's HTTP endpoint for suspicious access patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Tools > Firmware. If version is 24.04.18D1 R(68125), the device is vulnerable.Check Version:
curl -k https://[router-ip]/H5/state_view.data or check web interfaceVerify Fix Applied:
After updating firmware, verify the version has changed from 24.04.18D1 R(68125) to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual access to /H5/state_view.data endpoint
- Multiple failed or successful requests to router management interface from unexpected internal IPs
Network Indicators:
- HTTP GET requests to /H5/state_view.data from non-management hosts
- Unusual traffic patterns to router management interface
SIEM Query:
source="router-logs" AND (uri="/H5/state_view.data" OR user_agent="*exploit*")