CVE-2018-25358: D-Link DIR601 Credential Disclosure Flaw

CVE-2018-25358 Overview

CVE-2018-25358 is a credential disclosure vulnerability in the D-Link DIR-601 router running firmware version 2.02NA. The flaw resides in the /my_cgi.cgi endpoint, which accepts a table_name parameter in POST requests without enforcing authentication. Unauthenticated attackers on the network can request configuration tables such as admin_user, wireless_settings, and wireless_security to retrieve administrative credentials and wireless network keys in clear text. The weakness is categorized under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

Critical Impact

Unauthenticated network attackers can extract administrator credentials and Wi-Fi keys from the router, enabling full device takeover and lateral movement into the protected wireless network.

Affected Products

• D-Link DIR-601 router, firmware version 2.02NA
• Devices exposing the /my_cgi.cgi management endpoint to the local or wide area network
• End-of-life D-Link consumer router deployments still in production use

Discovery Timeline

• 2026-05-23 - CVE-2018-25358 published to the National Vulnerability Database
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25358

Vulnerability Analysis

The DIR-601 web management interface exposes the my_cgi.cgi handler to process configuration queries. The handler reads a table_name POST parameter and returns the corresponding configuration record without first validating an authenticated session. As a result, attackers can enumerate sensitive tables and receive their contents in the HTTP response body in plaintext.

Because credentials and pre-shared keys are stored and returned without encryption, a single unauthenticated request is enough to disclose the entire administrative credential set. Exploitation requires only network reachability to the router's HTTP service, which is typically exposed on the LAN and, in some deployments, on the WAN interface.

Root Cause

The root cause is missing authentication on a sensitive configuration endpoint combined with clear-text storage of credentials. The my_cgi.cgi handler treats the table_name parameter as a trusted selector and returns configuration data without verifying the requester's session, role, or origin.

Attack Vector

An attacker sends a crafted POST request to /my_cgi.cgi with table_name=admin_user to retrieve the administrator username and password. Repeating the request with table_name=wireless_settings and table_name=wireless_security discloses the SSID configuration and Wi-Fi pre-shared key. No credentials, user interaction, or prior access are required. Full technical reproduction steps are documented in the Exploit-DB entry #45002 and the VulnCheck advisory.

Detection Methods for CVE-2018-25358

Indicators of Compromise

• HTTP POST requests to /my_cgi.cgi containing table_name=admin_user, table_name=wireless_settings, or table_name=wireless_security
• Unexpected outbound responses from the router containing plaintext credential or PSK strings
• Repeated POST requests to my_cgi.cgi from a single internal or external source within a short interval

Detection Strategies

• Inspect router and upstream gateway access logs for any request path ending in my_cgi.cgi that originates from unauthenticated sessions
• Deploy network IDS signatures that match the table_name= parameter pattern in HTTP POST bodies destined for known DIR-601 IP addresses
• Use periodic configuration audits to confirm the router's web management interface is not reachable from untrusted networks

Monitoring Recommendations

• Forward router syslog and HTTP access events to a centralized log platform for retention and correlation
• Alert on administrator logins or configuration changes that follow my_cgi.cgi access from non-administrator hosts
• Monitor wireless authentication telemetry for new or unexpected clients joining the SSID after suspicious management activity

How to Mitigate CVE-2018-25358

Immediate Actions Required

• Block external access to the router's HTTP management interface at the perimeter and restrict LAN access to known administrative hosts
• Rotate the administrator password and the wireless pre-shared key, assuming both may already be disclosed
• Plan replacement of the DIR-601 with a currently supported router, as the device is end-of-life with no vendor patch available

Patch Information

No vendor patch is available for the D-Link DIR-601. The device is listed on the D-Link Canada product page as a legacy product. Affected operators should treat replacement as the primary remediation path. Refer to the VulnCheck advisory for ongoing status.

Workarounds

• Disable remote (WAN-side) administration and confirm the management UI is unreachable from the internet
• Segment the router onto an isolated VLAN and apply ACLs that only permit HTTP access from a trusted administrator workstation
• Replace WPA-PSK keys regularly until the device is decommissioned to limit the window of exposure if credentials are leaked

# Example perimeter ACL to block external access to the router management UI
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_interface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_interface> -j DROP