CVE-2025-34048

Description

A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device.

Reserved 2025-04-15 | Published 2025-06-26 | Updated 2025-06-26 | Assigner VulnCheck

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-20 Improper Input Validation

Product status

Default status
unaffected

IN_1.02
affected

Default status
unaffected

SEA_1.04
affected

SEA_1.07
affected

Default status
unaffected

SEA_1.04
affected

SEA_1.07
affected

Credits

Todor Donev finder

References

www.exploit-db.com/exploits/40735 exploit

github.com/.../routers/dlink/dsl_2730_2750_path_traversal.py exploit

www.dlink.com product

vulncheck.com/.../dlink-dsl-routers-path-traversal-file-read third-party-advisory

cve.org (CVE-2025-34048)

nvd.nist.gov (CVE-2025-34048)

Download JSON