cnvd - cnvd-2025-10950

cnvd-2025-10950

Vulnerability from cnvd

Title: D-Link DI-7003GV2 /H5/backup.asp文件拒绝服务漏洞

Description:

D-Link DI-7003GV2是中国友讯（D-Link）公司的一款路由器。

D-Link DI-7003GV2 存在拒绝服务漏洞，该漏洞源于文件/H5/backup.asp中函数sub_4983B0存在不当的访问控制，攻击者可利用该漏洞导致拒绝服务。

Severity: 高

Formal description:

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： http://www.dlink.com.cn/

Reference: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/backup.md

Impacted products

Name
D-Link DI-7003GV2 24.04.18D1 R(68125)

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-4749",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-4749"
    }
  },
  "description": "D-Link DI-7003GV2\u662f\u4e2d\u56fd\u53cb\u8baf\uff08D-Link\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u8def\u7531\u5668\u3002\n\nD-Link DI-7003GV2 \u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6587\u4ef6/H5/backup.asp\u4e2d\u51fd\u6570sub_4983B0\u5b58\u5728\u4e0d\u5f53\u7684\u8bbf\u95ee\u63a7\u5236\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttp://www.dlink.com.cn/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-10950",
  "openTime": "2025-05-29",
  "products": {
    "product": "D-Link DI-7003GV2 24.04.18D1 R(68125)"
  },
  "referenceLink": "https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/backup.md",
  "serverity": "\u9ad8",
  "submitTime": "2025-05-22",
  "title": "D-Link DI-7003GV2 /H5/backup.asp\u6587\u4ef6\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2025-4749 (GCVE-0-2025-4749)

Vulnerability from cvelistv5

Published

2025-05-16 05:00

Modified

2025-05-16 15:55

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-404 - Denial of Service

Summary

A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/backup.asp?opt=reset of the component Factory Reset Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

▼	URL	Tags
	https://vuldb.com/?id.309052	vdb-entry, technical-description
	https://vuldb.com/?ctiid.309052	signature, permissions-required
	https://vuldb.com/?submit.571068	third-party-advisory
	https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/backup.md	exploit
	https://www.dlink.com/	product

Impacted products

	Vendor	Product	Version
	D-Link	DI-7003GV2	Version: 24.04.18D1 R(68125)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4749",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T15:54:53.918477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T15:55:04.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Factory Reset Handler"
          ],
          "product": "DI-7003GV2",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "24.04.18D1 R(68125)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "153528990 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/backup.asp?opt=reset of the component Factory Reset Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
        },
        {
          "lang": "de",
          "value": "In D-Link DI-7003GV2 24.04.18D1 R(68125) wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion sub_4983B0 der Datei /H5/backup.asp?opt=reset der Komponente Factory Reset Handler. Durch das Manipulieren mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T05:00:09.105Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-309052 | D-Link DI-7003GV2 Factory Reset backup.asp sub_4983B0 denial of service",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.309052"
        },
        {
          "name": "VDB-309052 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.309052"
        },
        {
          "name": "Submit #571068 | D-Link DI-7003GV2 24.04.18D1 R(68125) Improper Access Controls",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.571068"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/backup.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.dlink.com/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-05-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-05-15T11:08:20.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "D-Link DI-7003GV2 Factory Reset backup.asp sub_4983B0 denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-4749",
    "datePublished": "2025-05-16T05:00:09.105Z",
    "dateReserved": "2025-05-15T09:02:59.051Z",
    "dateUpdated": "2025-05-16T15:55:04.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted