CVE-2025-9003: D-Link DIR-818LW XSS Vulnerability

CVE-2025-9003 Overview

CVE-2025-9003 is a cross-site scripting (XSS) vulnerability in the D-Link DIR-818LW wireless router running firmware version 1.04. The flaw resides in the /bsc_lan.php endpoint within the DHCP Reserved Address Handler component. Attackers can manipulate the Name argument to inject malicious script content that executes in the browser context of users viewing the affected page. The vulnerability is classified under CWE-79 and can be triggered remotely. D-Link no longer supports this product, meaning no official patch will be released.

Critical Impact
Remote attackers with low privileges can inject persistent script payloads into the router's administrative interface, potentially hijacking administrator sessions or altering device configuration through the browser.

Affected Products

D-Link DIR-818LW hardware (end-of-life)
D-Link DIR-818LW firmware version 1.04
Any deployment of the DIR-818LW exposing /bsc_lan.php to untrusted users

Discovery Timeline

2025-08-15 - CVE-2025-9003 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9003

Vulnerability Analysis

The vulnerability affects the DHCP Reserved Address Handler exposed through /bsc_lan.php in the DIR-818LW web administration interface. When an authenticated user submits a DHCP reservation entry, the Name field is stored and later rendered without proper output encoding. An attacker who can submit or influence a reservation entry can inject HTML or JavaScript that executes when an administrator loads the LAN configuration page. Because the payload persists in device configuration, every subsequent visit to the affected page re-triggers the script. The exploit requires network reachability to the router's management interface and user interaction to render the payload.

Root Cause

The root cause is missing output sanitization and encoding of user-supplied input in the DHCP reservation workflow. The Name parameter is written to persistent configuration storage and reflected back into the administrative UI as part of the DHCP reservations list. The /bsc_lan.php script does not apply contextual HTML encoding before emitting the stored value, allowing arbitrary markup and script content to execute in the administrator's browser session.

Attack Vector

An attacker initiates the attack remotely over the network by sending a crafted request to /bsc_lan.php that creates or modifies a DHCP reservation entry containing a malicious Name value. The attack requires authenticated access with low privileges and relies on user interaction, specifically an administrator or operator loading the DHCP reservation view. Successful exploitation executes attacker-controlled script in the context of the router's web interface. See the VulDB entry 320032 for additional technical details.

Detection Methods for CVE-2025-9003

Indicators of Compromise

Unexpected DHCP reservation entries in /bsc_lan.php containing HTML tags, JavaScript event handlers, or <script> elements in the Name field
Administrative session anomalies originating from the router web UI, including unexpected credential changes or configuration edits
Outbound HTTP requests from administrator workstations to unfamiliar domains immediately after accessing the router's LAN settings page

Detection Strategies

Inspect router configuration backups for DHCP reservation Name fields containing non-alphanumeric payloads indicative of script injection
Monitor HTTP POST requests to /bsc_lan.php for parameters containing angle brackets, javascript: URIs, or encoded script content
Correlate browser telemetry on administrator workstations with access to the router management interface to identify script execution originating from the device UI

Monitoring Recommendations

Restrict and log all access to the router's management interface at the network perimeter and alert on administrative sessions from unexpected sources
Capture and review web request traffic to embedded device management endpoints using network detection tooling
Baseline DHCP reservation entries and alert on changes containing suspicious character sets

How to Mitigate CVE-2025-9003

Immediate Actions Required

Remove the DIR-818LW from service or replace it with a supported model, since the device is end-of-life and will not receive a vendor patch
Isolate the router management interface from untrusted networks and restrict access to a dedicated management VLAN
Audit existing DHCP reservation entries and delete any records containing suspicious or non-standard Name values

Patch Information

No patch is available. D-Link has designated the DIR-818LW as an unsupported product, and the vendor advisory refers affected customers to the D-Link official website for end-of-life guidance. Replacement with a currently supported device is the recommended path.

Workarounds

Disable remote administration and limit web UI access to a single trusted management host
Require administrators to access the router UI from a hardened browser profile that blocks inline scripts
Place the router behind an upstream firewall that filters requests to /bsc_lan.php from unauthorized sources

bash

# Example firewall rule limiting router management access to a single admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP