CVE-2025-53757 Overview
CVE-2025-53757 affects the Digisol DG-GR6821AC Router. The router's web management interface issues session cookies without the Secure and HttpOnly flags. This misconfiguration allows session cookies to traverse unencrypted HTTP channels and remain accessible to client-side scripts. A remote attacker positioned on the network path can capture these cookies and reuse them to access the administrative interface. The weakness is tracked under CWE-614, which covers sensitive cookies missing the Secure attribute. CERT-In documented the issue in vulnerability note CIVN-2025-0147.
Critical Impact
Attackers who intercept cleartext traffic or execute scripts in the router's web interface can steal session cookies and obtain sensitive information from the device.
Affected Products
- Digisol DG-GR6821AC Router (web management interface)
Discovery Timeline
- 2025-07-16 - CVE-2025-53757 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-53757
Vulnerability Analysis
The Digisol DG-GR6821AC router web interface generates authentication session cookies without the Secure and HttpOnly attributes. The Secure attribute instructs browsers to transmit cookies only over HTTPS. The HttpOnly attribute blocks JavaScript access to cookies via document.cookie. With neither flag set, cookies travel over plaintext HTTP requests and remain readable by any script running in the page context.
An attacker on the same local network can passively sniff HTTP traffic to recover an administrator's session cookie. The attacker then replays the cookie against the router's web interface to access configuration data without supplying credentials. Reflected or stored script injection in the management UI would also expose the cookie value to attacker-controlled JavaScript.
The vulnerability is classified under CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. The EPSS model estimates a 0.482% exploitation probability over the next 30 days.
Root Cause
The router's HTTP server emits Set-Cookie headers for session identifiers without appending the Secure or HttpOnly directives. The web server configuration treats session cookies the same as non-sensitive cookies, exposing them to interception and client-side script access.
Attack Vector
Exploitation requires network adjacency to capture HTTP traffic or the ability to inject script into the management interface. An attacker on the LAN, an upstream network segment, or a compromised host on the same broadcast domain can run a packet capture to harvest cookies. Once captured, the cookie is replayed against the router web interface to impersonate the authenticated session.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in the CERT-In Vulnerability Note CIVN-2025-0147.
Detection Methods for CVE-2025-53757
Indicators of Compromise
- Unexpected administrative logins to the Digisol DG-GR6821AC web interface from unfamiliar internal hosts.
- Configuration changes on the router (DNS, DHCP, firewall rules) without a corresponding administrator action.
- HTTP Set-Cookie responses from the router that omit Secure and HttpOnly attributes.
Detection Strategies
- Inspect HTTP responses from the router using a proxy or browser developer tools and confirm whether session cookies include the Secure and HttpOnly flags.
- Capture LAN traffic with a network analyzer and flag plaintext HTTP sessions carrying router authentication cookies.
- Correlate router admin access logs with known administrator workstations to identify session reuse from unauthorized sources.
Monitoring Recommendations
- Enable logging on the router and forward events to a central log platform for review of administrative actions.
- Monitor ARP tables and switch port activity for signs of network sniffing or man-in-the-middle staging on the management VLAN.
- Alert on configuration changes to DNS, WAN, or remote management settings on the affected device.
How to Mitigate CVE-2025-53757
Immediate Actions Required
- Restrict access to the router web interface to a dedicated management VLAN or trusted management hosts.
- Disable remote (WAN-side) management on the DG-GR6821AC until a vendor fix is applied.
- Force administrators to log out after each session and clear browser cookies after accessing the router.
- Track vendor and CERT-In updates for an official firmware release addressing CVE-2025-53757.
Patch Information
No vendor patch is referenced in the available advisory data. Administrators should consult Digisol support and the CERT-In Vulnerability Note CIVN-2025-0147 for firmware updates as they become available.
Workarounds
- Access the router only from an isolated, wired management host to reduce exposure to passive sniffing.
- Place the router management interface behind a reverse proxy or VPN that enforces HTTPS and adds Secure and HttpOnly flags to session cookies.
- Change the administrator password after each management session to invalidate any captured cookies tied to the prior session.
- Segment IoT and guest devices away from the router management network to limit who can observe management traffic.
# Example: restrict router management to a single admin host via an upstream firewall
# Replace 192.168.1.1 with the router IP and 192.168.10.25 with the admin workstation IP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -s 192.168.10.25 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -s 192.168.10.25 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
