CVE-2025-4903 Overview
CVE-2025-4903 affects the D-Link DI-7003GV2 router running firmware version 24.04.18D1 R(68125). The vulnerability resides in the sub_41F4F0 function reachable through the /H5/webgl.asp endpoint with the parameters tggl_port=0&remote_management=0&http_passwd=game&exec_service=admin-restart. Manipulation of the request triggers an unverified password change [CWE-620], allowing remote attackers to alter credentials without authenticating or supplying the current password. The exploit details have been publicly disclosed.
Critical Impact
Remote, unauthenticated attackers can change router account passwords through the webgl.asp endpoint, leading to administrative takeover of affected D-Link DI-7003GV2 devices.
Affected Products
- D-Link DI-7003GV2 hardware revision v2
- D-Link DI-7003G firmware version 24.04.18D1 R(68125)
- Deployments exposing the device web management interface to untrusted networks
Discovery Timeline
- 2025-05-19 - CVE-2025-4903 published to the National Vulnerability Database (NVD)
- 2025-05-27 - Last updated in NVD database
Technical Details for CVE-2025-4903
Vulnerability Analysis
The flaw exists in the sub_41F4F0 function handling requests to /H5/webgl.asp. The handler accepts a new password through the http_passwd query parameter and applies it without verifying the requester's identity or the existing credential. The CWE-620 classification [Unverified Password Change] reflects this missing authentication step on a state-changing operation.
Because the affected endpoint is part of the device's HTTP management interface, the attack is reachable across the network with low complexity and no user interaction. The EPSS model places this issue in the 82nd percentile for likelihood of exploitation activity.
Root Cause
The webgl.asp handler omits authentication and current-password validation before persisting the supplied http_passwd value. Trust is implicitly granted to any caller who can reach the endpoint, which violates a basic identity-proof requirement for credential modification operations.
Attack Vector
An attacker sends a crafted HTTP request to /H5/webgl.asp?tggl_port=0&remote_management=0&http_passwd=<new_password>&exec_service=admin-restart over the network. The router accepts the new password and restarts the admin service, locking out the legitimate operator. The attack requires no credentials, no user interaction, and exposes the device to full administrative takeover. For technical specifics, see the GitHub Vulnerability Report and VulDB #309459.
Detection Methods for CVE-2025-4903
Indicators of Compromise
- HTTP requests to /H5/webgl.asp containing the http_passwd parameter from external or unexpected source addresses
- Unscheduled invocations of exec_service=admin-restart against the management interface
- Sudden inability of administrators to log in with previously valid credentials on DI-7003GV2 devices
- Unexpected administrative configuration changes following web management traffic spikes
Detection Strategies
- Inspect web server and reverse proxy logs for requests matching the vulnerable URI pattern with http_passwd and exec_service parameters
- Correlate router admin-service restarts with preceding HTTP traffic to the management interface
- Alert on management plane access originating from WAN interfaces or non-administrative VLANs
Monitoring Recommendations
- Forward router syslog and HTTP access logs to a centralized SIEM for retention and correlation
- Track baseline administrator login patterns and alert on credential resets occurring outside change windows
- Monitor outbound connections initiated by the router that could indicate post-compromise activity
How to Mitigate CVE-2025-4903
Immediate Actions Required
- Restrict access to the DI-7003GV2 web management interface to trusted management networks only, blocking WAN-side exposure
- Disable remote management features until a vendor-supplied fix is available
- Place affected devices behind a firewall that denies inbound HTTP/HTTPS to the router management port
- Audit administrator accounts and password hashes for unauthorized changes
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry. Consult the D-Link Official Website and the VulDB advisory for updates. Apply firmware updates immediately once released by D-Link.
Workarounds
- Block external access to /H5/webgl.asp at an upstream firewall or web application gateway
- Segment the router management VLAN and require VPN access for any administrative session
- Replace end-of-life or unmaintained DI-7003GV2 deployments with currently supported equipment if no patch is forthcoming
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
