Details of VAR-202503-0519

ID

VAR-202503-0519

CVE

CVE-2025-2360

TITLE

D-Link Systems, Inc. of DIR-823G Vulnerability regarding improper permission settings in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-009079

DESCRIPTION

A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DIR-823G The firmware contains vulnerabilities related to improper permission settings and authorization vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-823G is a wireless router of D-Link, a Chinese company. Attackers can exploit this vulnerability to access sensitive content

Trust: 2.16

sources: NVD: CVE-2025-2360 // JVNDB: JVNDB-2025-009079 // CNVD: CNVD-2025-12301

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-12301

AFFECTED PRODUCTS

vendor:	dlink	model:	dir-823g	scope:	eq	version:	1.0.2b05_20181207	Trust: 1.0
vendor:	d link	model:	dir-823g	scope:	eq	version:	-	Trust: 0.8
vendor:	d link	model:	dir-823g	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dir-823g	scope:	eq	version:	dir-823g firmware 1.0.2b05 20181207	Trust: 0.8
vendor:	d link	model:	dir-823g 1.0.2b05 20181207	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-12301 // JVNDB: JVNDB-2025-009079 // NVD: CVE-2025-2360

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-2360
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2025-2360
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2025-009079
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-12301
value:	HIGH
Trust: 0.6

cna@vuldb.com:	CVE-2025-2360
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-009079
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-12301
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-2360
baseSeverity:	HIGH
baseScore:	7.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2025-2360
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2025-009079
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-12301 // JVNDB: JVNDB-2025-009079 // NVD: CVE-2025-2360 // NVD: CVE-2025-2360

PROBLEMTYPE DATA

problemtype:	CWE-266	Trust: 1.0
problemtype:	CWE-285	Trust: 1.0
problemtype:	Improper permission settings (CWE-266) [ others ]	Trust: 0.8
problemtype:	Inappropriate authorization (CWE-285) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-009079 // NVD: CVE-2025-2360

EXTERNAL IDS

db:	NVD	id:	CVE-2025-2360	Trust: 3.2
db:	VULDB	id:	299827	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-009079	Trust: 0.8
db:	CNVD	id:	CNVD-2025-12301	Trust: 0.6

sources: CNVD: CNVD-2025-12301 // JVNDB: JVNDB-2025-009079 // NVD: CVE-2025-2360

REFERENCES

url:	https://lavender-bicycle-a5a.notion.site/d-link-dir-823g-setupnpsettings-1ac53a41781f80d1a290c8d5da3e795e?pvs=4	Trust: 1.8
url:	https://vuldb.com/?id.299827	Trust: 1.8
url:	https://vuldb.com/?submit.513751	Trust: 1.8
url:	https://www.dlink.com/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-2360	Trust: 1.4
url:	https://vuldb.com/?ctiid.299827	Trust: 1.0

sources: CNVD: CNVD-2025-12301 // JVNDB: JVNDB-2025-009079 // NVD: CVE-2025-2360

SOURCES

db:	CNVD	id:	CNVD-2025-12301
db:	JVNDB	id:	JVNDB-2025-009079
db:	NVD	id:	CVE-2025-2360

LAST UPDATE DATE

2025-07-18T23:10:13.186000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-12301	date:	2025-06-12T00:00:00
db:	JVNDB	id:	JVNDB-2025-009079	date:	2025-07-17T00:59:00
db:	NVD	id:	CVE-2025-2360	date:	2025-07-15T16:49:51.617

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-12301	date:	2025-06-12T00:00:00
db:	JVNDB	id:	JVNDB-2025-009079	date:	2025-07-17T00:00:00
db:	NVD	id:	CVE-2025-2360	date:	2025-03-17T04:15:16.090