CVE-2025-4753 Overview
CVE-2025-4753 is an information disclosure vulnerability affecting the D-Link DI-7003GV2 router running firmware version 24.04.18D1 R(68125). The flaw resides in unknown functionality of the /login.data file, which exposes sensitive information to unauthenticated remote attackers. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed devices.
Critical Impact
Remote unauthenticated attackers can retrieve sensitive information from the /login.data endpoint without user interaction, enabling reconnaissance and potential follow-on attacks against the router.
Affected Products
- D-Link DI-7003GV2 hardware revision v2
- D-Link DI-7003G firmware version 24.04.18D1 R(68125)
- D-Link DI-7003G series router deployments running the affected firmware build
Discovery Timeline
- 2025-05-16 - CVE-2025-4753 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4753
Vulnerability Analysis
The vulnerability exists in an unspecified handler that serves the /login.data resource on the D-Link DI-7003GV2 router web interface. When an attacker requests this file, the device returns sensitive data without enforcing authentication or authorization controls. The disclosed information can aid an attacker in reconnaissance, credential targeting, or preparing subsequent attacks against the management interface.
The issue is a classic instance of CWE-200, where the application exposes data intended to remain confidential. Because the endpoint is reachable over the network and requires no privileges or user interaction, exploitation is straightforward with standard HTTP tooling.
Root Cause
The root cause is missing access control on the /login.data resource served by the router's embedded web management application. The handler does not validate session state or restrict the response to authenticated administrators. Sensitive fields that should remain internal are serialized into the response body and returned to any HTTP client.
Attack Vector
Exploitation requires only network reachability to the router's web management port. An attacker sends an HTTP GET request to the /login.data path on an exposed DI-7003GV2 device. The device responds with information that supports further attacks such as credential brute-force, targeted phishing against administrators, or exploitation of related management endpoints. Devices with the web interface exposed to the internet face the highest risk.
See the public write-up at GitHub Vulnerability Documentation and the VulDB entry #309056 for additional technical context.
Detection Methods for CVE-2025-4753
Indicators of Compromise
- HTTP GET requests to the /login.data path on DI-7003GV2 management interfaces, particularly from external or unknown source addresses
- Repeated unauthenticated requests to router administrative URIs from a single IP or scanning infrastructure
- Router access logs showing responses to /login.data returning non-empty payloads to unauthenticated clients
Detection Strategies
- Deploy network intrusion detection signatures that flag HTTP requests targeting /login.data on D-Link DI-7003G devices
- Baseline normal administrative traffic to the router and alert on off-hours or external access to management URIs
- Correlate web request logs with authentication events to identify unauthenticated access to sensitive resources
Monitoring Recommendations
- Forward router web server and management logs to a centralized logging platform for retention and correlation
- Monitor for exposure of the router management interface on public-facing IP addresses using external attack surface scans
- Track outbound connections from the router that could indicate post-exploitation activity following information disclosure
How to Mitigate CVE-2025-4753
Immediate Actions Required
- Restrict access to the DI-7003GV2 web management interface to trusted internal networks and administrative jump hosts only
- Disable remote (WAN-side) administration on affected routers until a vendor patch is applied
- Rotate administrator credentials and any secrets that may have been exposed through the /login.data endpoint
- Review router logs for prior requests to /login.data from untrusted sources
Patch Information
At the time of publication, no vendor security advisory or firmware update addressing CVE-2025-4753 has been published on the D-Link Official Site. Administrators should monitor D-Link support channels for a firmware release superseding version 24.04.18D1 R(68125) and apply it as soon as it becomes available.
Workarounds
- Place the DI-7003GV2 behind a firewall that blocks inbound HTTP/HTTPS to the router management interface from untrusted networks
- Enforce administrative access exclusively through VPN or a bastion host to eliminate direct exposure of the web interface
- Segment the router management network from user and guest networks using VLANs and access control lists
- Consider replacing internet-exposed DI-7003GV2 devices with supported hardware if a vendor patch is not released in a timely manner
# Example iptables rule restricting router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
