CVE-2025-4750: D-Link DI-7003G Information Disclosure Flaw

CVE-2025-4750 Overview

CVE-2025-4750 is an information disclosure vulnerability in the D-Link DI-7003GV2 router running firmware version 24.04.18D1 R(68125). The flaw resides in the Configuration Handler component, specifically in the processing of the /H5/get_version.data endpoint. An unauthenticated remote attacker can query this endpoint to retrieve sensitive device information without any authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning against exposed devices. The weakness is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Remote, unauthenticated attackers can retrieve version and configuration data from affected D-Link DI-7003GV2 routers, aiding reconnaissance and follow-on exploitation.

Affected Products

D-Link DI-7003GV2 hardware revision v2
D-Link DI-7003G firmware version 24.04.18D1 R(68125)
Deployments exposing the web management interface on untrusted networks

Discovery Timeline

2025-05-16 - CVE-2025-4750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4750

Vulnerability Analysis

The vulnerability exists in the request handler that services the /H5/get_version.data URI on the DI-7003GV2 web management interface. The handler returns device metadata without validating that the requester holds an authenticated session. Because the endpoint is reachable over the network and requires no privileges, attackers can query it directly with a standard HTTP client.

The disclosed data supports reconnaissance activities such as fingerprinting firmware revisions, mapping exposed devices at scale, and correlating identifiers with other known vulnerabilities in the DI-7003G product line. Attackers commonly chain this type of pre-authentication disclosure with subsequent command injection or authentication bypass flaws affecting the same platform.

Root Cause

The root cause is missing access control on the get_version.data handler within the Configuration Handler component. The endpoint was designed to serve version data to the web UI but lacks a session or privilege check, so any HTTP client that can reach the management interface receives the response.

Attack Vector

Exploitation is performed over the network with a single unauthenticated HTTP request to the /H5/get_version.data path on the router's management interface. No user interaction, credentials, or prior foothold are required. A public proof of concept is available through the GitHub PoC Repository and VulDB entry #309053.

Detection Methods for CVE-2025-4750

Indicators of Compromise

HTTP GET requests to the URI /H5/get_version.data from external or otherwise untrusted source addresses
Repeated probes of the router web interface from a single source, often paired with requests to other /H5/*.data endpoints
User-Agent strings associated with mass scanners (curl, python-requests, masscan, zgrab) targeting the management port

Detection Strategies

Deploy web server or WAF logging on the router management interface and alert on unauthenticated hits to /H5/get_version.data
Correlate network flow data to identify Internet-sourced connections reaching router management ports
Compare firmware version strings served to external clients with an inventory of expected DI-7003GV2 assets

Monitoring Recommendations

Enable syslog forwarding from the DI-7003GV2 to a central log platform and retain HTTP request logs
Alert on any exposure of router administration interfaces to public IP ranges
Track the VulDB CTI record #309053 for updated exploit intelligence and indicator changes

How to Mitigate CVE-2025-4750

Immediate Actions Required

Restrict access to the DI-7003GV2 web management interface so it is reachable only from trusted management subnets
Block inbound Internet access to the router's HTTP and HTTPS administration ports at the perimeter
Audit device logs for prior requests to /H5/get_version.data originating from untrusted networks
Review the D-Link Official Website for firmware updates addressing the DI-7003GV2 platform

Patch Information

At the time of NVD publication, no vendor advisory or fixed firmware release is listed for CVE-2025-4750. Administrators should monitor D-Link security bulletins for a patched firmware version superseding 24.04.18D1 R(68125) and apply it once available.

Workarounds

Place the router management interface behind a VPN or jump host to eliminate direct network exposure
Apply firewall access control lists (ACLs) that limit source addresses permitted to reach the administration port
Disable remote administration features if they are not required for operations
Segment the router's management VLAN from user and guest networks to reduce internal exposure

bash

# Example ACL restricting router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP