Listen to this Post
How the CVE Works
CVE-2025-2549 exploits improper access controls in D-Link DIR-618 and DIR-605L firmware versions 2.02/3.02. The vulnerability lies in the `/goform/formSetPassword` endpoint, which fails to enforce proper authentication checks. An attacker within the local network can manipulate this endpoint to change device credentials without authorization. Since these devices are unsupported, no patches are expected, leaving them permanently exposed to local network attacks.
DailyCVE Form
Platform: D-Link routers
Version: 2.02/3.02
Vulnerability: Improper access control
Severity: Medium
Date: 07/15/2025
Prediction: No patch expected
What Undercode Say
curl -X POST http://<TARGET_IP>/goform/formSetPassword -d "password=attacker_controlled"
import requests
requests.post("http://<TARGET_IP>/goform/formSetPassword", data={"password": "malicious"})
How Exploit
1. Attacker sends crafted POST request to `/goform/formSetPassword`.
2. Endpoint processes request without authentication.
3. Device password changed to attacker-defined value.
Protection from this CVE
- Discontinue use of affected devices.
- Segment local network.
- Block unauthorized LAN access.
Impact
- Unauthorized credential modification.
- Persistent device compromise.
- Limited to local network attackers.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
