CVE-2025-4752 Overview
CVE-2025-4752 is an information disclosure vulnerability affecting the D-Link DI-7003GV2 router running firmware version 24.04.18D1 R(68125). The flaw resides in the handling of the /install_base.data file, which can be accessed remotely without authentication. An unauthenticated attacker can retrieve sensitive configuration data by requesting this file over the network. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse against exposed devices. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Remote unauthenticated attackers can retrieve sensitive information from affected D-Link DI-7003GV2 devices by accessing the /install_base.data endpoint, potentially exposing configuration data useful for follow-on attacks.
Affected Products
- D-Link DI-7003GV2 hardware (revision v2)
- D-Link DI-7003G firmware version 24.04.18D1 R(68125)
- Deployments exposing the device management interface to untrusted networks
Discovery Timeline
- 2025-05-16 - CVE-2025-4752 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4752
Vulnerability Analysis
The vulnerability affects an unspecified function that serves the /install_base.data resource on the DI-7003GV2 web interface. Requests to this path return data that should not be exposed to unauthenticated clients. Because the endpoint is reachable over the network and requires no privileges or user interaction, attackers can automate retrieval at scale. Public disclosure of the exploit technique on GitHub lowers the barrier to abuse. The EPSS score of 0.953% reflects moderate near-term exploitation probability relative to other published CVEs.
Root Cause
The root cause is missing access control on the /install_base.data resource. The web server delivers the file without validating the requester's session, authentication state, or authorization level. This mapping between an unauthenticated HTTP request and sensitive backend data results in the [CWE-200] information exposure.
Attack Vector
The attack vector is fully remote and network-based. An attacker sends a crafted HTTP request to the /install_base.data path on the router's management interface. No credentials, tokens, or prior session state are required. The response returns installation or configuration data that supports reconnaissance and enables follow-on attacks against the device or the network behind it. Refer to the GitHub vulnerability documentation and the VulDB entry #309055 for the disclosed request details.
Detection Methods for CVE-2025-4752
Indicators of Compromise
- HTTP GET requests targeting /install_base.data on DI-7003GV2 management interfaces
- Successful HTTP 200 responses to unauthenticated requests for /install_base.data
- Repeated probing from single source addresses across router management ports
Detection Strategies
- Inspect web server and reverse proxy logs on the router or upstream network devices for requests to /install_base.data.
- Deploy network intrusion detection signatures matching the disclosed URI pattern against traffic destined for D-Link DI-7003GV2 devices.
- Correlate access to sensitive endpoints with source IP reputation to identify opportunistic scanners.
Monitoring Recommendations
- Continuously monitor management-interface traffic for anomalous unauthenticated file access.
- Alert on outbound data flows from router management planes to untrusted destinations.
- Track firmware version inventory to identify DI-7003G devices running 24.04.18D1 R(68125) or earlier.
How to Mitigate CVE-2025-4752
Immediate Actions Required
- Restrict access to the DI-7003GV2 management interface to trusted administrative networks only.
- Block inbound requests to /install_base.data at upstream firewalls, WAFs, or load balancers.
- Audit exposed D-Link DI-7003G devices via internet-facing asset inventories and remove unnecessary WAN-side exposure.
Patch Information
At the time of publication no vendor advisory or fixed firmware release is listed in the referenced sources. Administrators should monitor the D-Link official website for firmware updates addressing CVE-2025-4752 and apply them once available.
Workarounds
- Place the router management interface behind a VPN and disable WAN-side administrative access.
- Configure ACLs to deny HTTP requests matching the /install_base.data path from untrusted sources.
- Segment the router management VLAN from user and guest networks to limit lateral reconnaissance.
# Example upstream firewall rule to block the disclosed URI (illustrative)
iptables -I FORWARD -p tcp --dport 80 -m string --string "/install_base.data" --algo bm -j DROP
iptables -I FORWARD -p tcp --dport 443 -d <router_ip> -s ! <mgmt_subnet> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
