CVE-2025-4904: D-Link DI-7003G Information Disclosure Flaw

CVE-2025-4904 Overview

CVE-2025-4904 is an information disclosure vulnerability affecting the D-Link DI-7003GV2 router running firmware version 24.04.18D1 R(68125). The flaw resides in the sub_41F0FC function within the /H5/webgl.data file. Attackers can trigger the vulnerability remotely without authentication or user interaction to expose sensitive information from the affected device. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed devices. This weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote unauthenticated attackers can retrieve sensitive information from vulnerable D-Link DI-7003GV2 devices through crafted requests to the /H5/webgl.data endpoint.

Affected Products

D-Link DI-7003G (hardware version v2)
D-Link DI-7003G Firmware 24.04.18D1 R(68125)
D-Link DI-7003GV2 series routers

Discovery Timeline

2025-05-19 - CVE-2025-4904 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4904

Vulnerability Analysis

The vulnerability affects the sub_41F0FC function referenced within the /H5/webgl.data file on the D-Link DI-7003GV2. Manipulation of input to this function results in the unauthorized disclosure of information from the device. The vulnerability is reachable over the network and does not require credentials or user interaction, which lowers the barrier for exploitation against internet-facing management interfaces.

According to the GitHub vulnerability notes and VulDB entry #309460, the exploit has been publicly disclosed. The EPSS score is approximately 1.03% at the 59.6 percentile as of 2026-07-07.

Root Cause

The root cause is improper access control on data returned by the sub_41F0FC handler tied to the /H5/webgl.data resource. The function returns information that should not be accessible to unauthenticated remote clients. This maps to [CWE-200], indicating that the device exposes information to actors that are not explicitly authorized to view it.

Attack Vector

Exploitation requires only network access to the vulnerable router's HTTP interface. An attacker sends a crafted request targeting the /H5/webgl.data endpoint and parses the response to extract disclosed data. Because the attack requires no authentication and no user interaction, automated scanning against exposed devices is trivial to implement. Technical proof-of-concept notes are available in the researcher's public write-up on GitHub.

Detection Methods for CVE-2025-4904

Indicators of Compromise

Unexpected HTTP GET requests targeting the /H5/webgl.data path on the router's management interface.
Requests from external IP addresses reaching the web management service of DI-7003GV2 devices.
Repeated access to /H5/ resources from scanners or unknown user-agents.

Detection Strategies

Inspect router web server access logs for requests to /H5/webgl.data originating from untrusted networks.
Correlate access to router management URLs with source geolocation and prior authentication activity to identify unauthenticated probes.
Use network intrusion detection signatures matching HTTP requests to the /H5/webgl.data path on D-Link management ports.

Monitoring Recommendations

Forward router logs and network flow data to a centralized logging platform for retention and correlation.
Alert on any WAN-side HTTP or HTTPS access to the DI-7003GV2 management interface.
Baseline expected LAN-side administrative traffic and flag deviations, particularly repeated /H5/ resource requests.

How to Mitigate CVE-2025-4904

Immediate Actions Required

Restrict management interface access to trusted internal networks and disable WAN-side administration on the DI-7003GV2.
Place the router behind a firewall that blocks external access to HTTP/HTTPS management ports.
Audit device configuration and rotate any credentials that may have been exposed through the disclosed data.

Patch Information

No vendor advisory or patch has been published in the referenced sources at the time of NVD publication. Monitor the D-Link official website and VulDB CTI entry #309460 for firmware updates addressing CVE-2025-4904. Apply firmware updates as soon as D-Link releases a fixed version for the DI-7003GV2.

Workarounds

Disable remote management on the WAN interface and permit administrative access only from a restricted management VLAN.
Deploy network ACLs to block unauthenticated HTTP requests to /H5/webgl.data at upstream security devices.
Consider replacing exposed DI-7003GV2 units with supported hardware if a vendor patch is not available in a reasonable timeframe.

bash

# Example ACL to block WAN access to router management interface
iptables -I INPUT -i <wan_iface> -p tcp --dport 80 -j DROP
iptables -I INPUT -i <wan_iface> -p tcp --dport 443 -j DROP

# Example upstream filter to block requests to the vulnerable path
# (adjust for your web proxy or WAF syntax)
location ~* /H5/webgl\.data {
    deny all;
    return 403;
}