CVE-2025-60344
HIGH EPSS 95.1%
Published Oct 21, 20258mo ago · Modified Jun 17, 20261w ago
8.6 CVSS 3.1
Published Oct 21, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago
Description
A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
95.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-24
References 2
- github.com https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/
- github.com https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.