CVE-2025-4903
📋 TL;DR
This critical vulnerability in D-Link DI-7003GV2 routers allows remote attackers to change passwords without verification via a specific web interface function. Attackers can exploit this to gain administrative access to affected routers. Only D-Link DI-7003GV2 routers running firmware version 24.04.18D1 R(68125) are affected.
💻 Affected Systems
- D-Link DI-7003GV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to change admin credentials, intercept network traffic, deploy malware, and use router as pivot point into internal network.
Likely Case
Unauthorized administrative access leading to router configuration changes, network monitoring, and potential credential theft.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Exploit details publicly disclosed on GitHub. Attack requires sending crafted HTTP request to specific endpoint with password parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
1. Check D-Link website for security advisories
2. If patch available, download firmware update
3. Upload via router admin interface
4. Verify update applied successfully
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to vulnerable web interface
Access router admin panel > Security > Remote Management > Disable
Restrict Web Interface Access
allLimit access to router admin interface to trusted IPs only
Access router admin panel > Security > Access Control > Add trusted IP ranges
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to /H5/webgl.asp endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 24.04.18D1 R(68125), system is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Version pageVerify Fix Applied:
After applying any workaround, attempt to access /H5/webgl.asp?tggl_port=0&remote_management=0&http_passwd=game&exec_service=admin-restart from untrusted network. Should be inaccessible.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /H5/webgl.asp with password parameters
- Multiple failed login attempts followed by successful admin access
- Router configuration changes from unexpected IP addresses
Network Indicators:
- HTTP POST requests to router IP on port 80/443 containing 'webgl.asp' and 'http_passwd' parameter
- Unusual outbound traffic from router to external IPs
SIEM Query:
source="router_logs" AND (url="*webgl.asp*" OR message="*password change*" OR user="admin" AND src_ip NOT IN [trusted_ips])