CVE-2025-2546: D-Link DIR-605L Auth Bypass Vulnerability

CVE-2025-2546 Overview

CVE-2025-2546 is an improper access control vulnerability affecting D-Link DIR-618 firmware version 2.02 and DIR-605L firmware version 3.02. The flaw resides in the /goform/formAdvFirewall endpoint within the Firewall Service component. An attacker on the adjacent network can manipulate the endpoint to bypass access restrictions on firewall configuration. The weakness is classified under [CWE-266: Incorrect Privilege Assignment]. Both affected router models have reached end-of-life status and receive no further security updates from D-Link. The exploit technique has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed devices on local networks.

Critical Impact
Adjacent network attackers can alter firewall policy on unsupported D-Link routers, weakening perimeter defenses and enabling downstream network compromise.

Affected Products

D-Link DIR-618 router with firmware version 2.02
D-Link DIR-605L router with firmware version 3.02
End-of-life D-Link SOHO router hardware in these firmware ranges

Discovery Timeline

2025-03-20 - CVE-2025-2546 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2546

Vulnerability Analysis

The vulnerability affects the formAdvFirewall handler served through the router's web management interface at /goform/formAdvFirewall. This endpoint controls advanced firewall configuration on the DIR-618 and DIR-605L platforms. The handler does not properly enforce access control checks before processing configuration changes. An attacker connected to the same local network segment can send crafted HTTP requests to the endpoint and modify firewall state without holding the required privileges. D-Link no longer maintains these product lines, so no vendor patch will be issued. Public disclosure of the exploitation path lowers the barrier for attackers targeting residual deployments in home offices and small business networks.

Root Cause

The root cause is an authorization gap in the formAdvFirewall request handler. The firmware fails to validate the caller's session or privilege level before applying supplied parameters. This corresponds to CWE-266, where operations that should require administrative rights execute with insufficient privilege verification. Legacy code paths in the discontinued firmware retained assumptions that requests to /goform/ endpoints originated from an authenticated administrative session.

Attack Vector

Exploitation requires network adjacency to the target device, such as a wired or wireless connection to the router's local area network. The attacker sends an HTTP request to /goform/formAdvFirewall with parameters that alter firewall rules. No user interaction and no prior authentication are required. Successful exploitation reduces the integrity of firewall policy, which can permit inbound traffic that would otherwise be blocked or expose management services to broader network access. The vulnerability has been publicly documented in third-party writeups referenced by VulDB Entry #300160, D-Link DIR-618 formAdvFirewall analysis, and D-Link DIR-605L formAdvFirewall analysis.

No verified proof-of-concept code is published in this CVE record. Refer to the linked writeups for parameter-level technical details.

Detection Methods for CVE-2025-2546

Indicators of Compromise

Unexpected HTTP POST requests to /goform/formAdvFirewall originating from non-administrative hosts on the LAN
Unexplained modifications to firewall rules, port forwarding entries, or inbound access lists on affected routers
New inbound traffic reaching internal hosts on ports that were previously blocked by the router firewall

Detection Strategies

Enable and forward router syslog to a central collector, then alert on configuration change events for the firewall subsystem
Baseline outbound and inbound firewall rules on affected devices and generate alerts when the running configuration diverges from the baseline
Inspect LAN traffic for HTTP requests targeting /goform/ administrative endpoints from client IPs that are not designated admin workstations

Monitoring Recommendations

Monitor for lateral movement or scanning activity on segments that host end-of-life D-Link routers
Track authentication failures and administrative session activity on router management interfaces
Correlate firewall rule changes with recent client join events on the local network to identify rogue devices

How to Mitigate CVE-2025-2546

Immediate Actions Required

Replace affected DIR-618 and DIR-605L devices with a supported router platform, as recommended by D-Link end-of-life guidance on the D-Link Official Website
Restrict access to the router's web management interface to a dedicated management VLAN or a single administrative host
Disable remote management and confirm the LAN-side management port is not reachable from untrusted wireless segments
Segment guest and IoT devices away from any network segment that can reach the router's administrative interface

Patch Information

D-Link classifies the DIR-618 and DIR-605L as no longer supported. No firmware patch will be released for CVE-2025-2546. The only vendor-endorsed remediation is hardware replacement with a currently supported model.

Workarounds

Place the router behind an upstream firewall that enforces access control on the management subnet
Use client isolation on the wireless network to prevent LAN peers from reaching the router's /goform/ endpoints
Change default administrative credentials and audit the running configuration on a recurring schedule until the device is decommissioned

bash

# Example: restrict router admin interface access using an upstream Linux gateway
# Allow only the admin workstation (192.0.2.10) to reach the router (192.0.2.1) web UI
iptables -I FORWARD -s 192.0.2.10 -d 192.0.2.1 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 192.0.2.1 -p tcp --dport 443 -j DROP