D-Link DIR-803 CVE-2025-14528

Exploitation requires network reachability to the HTTP management interface of a D-Link DIR-803 router running firmware up to 1.04, then a request to the /getcfg.php endpoint (Configuration Handler) with the AUTHORIZED_GROUP argument manipulated to bypass authentication. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and default configurations are affected since the vulnerable endpoint is part of the standard web management component. The principal limiting factors are deployment scope - only this specific retired model/firmware - and whether the admin interface is reachable from the attacker's position (LAN-only versus WAN-exposed); impact is bounded to information disclosure with no integrity or availability effect.

This is a moderate-risk information-disclosure flaw whose signals are mostly aligned but point to limited real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, and the impact is confined to a low confidentiality breach (VC:L) with no integrity or availability impact - consistent with the CWE-200 information-disclosure classification and the reference title describing an authentication bypass against /getcfg.php. EPSS is 3.99% but sits at the 90th percentile, indicating relatively elevated exploitation likelihood versus the broader CVE population, which is plausible given that functional exploit code is publicly available. However, the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation - the public POC and elevated EPSS percentile indicate opportunistic risk rather than verified in-the-wild campaigns. The most important mitigating reality is that D-Link has explicitly declared this product end-of-life and unsupported, so no vendor patch will be issued; this raises long-term exposure for any still-deployed units but does not change the inherently low technical impact. Net: a genuine but low-priority issue for most organizations unless they operate these specific retired routers at the network edge.

A remote attacker who can reach the router's web management interface sends a crafted request to /getcfg.php manipulating the AUTHORIZED_GROUP parameter to bypass authentication and read configuration data, potentially including credentials or settings. A public exploit/write-up exists (titled 'DIR-803 Authentication Bypass'), lowering the barrier to reproduction. Because the attack is network-based, unauthenticated, and low-complexity, any device with an internet- or LAN-exposed admin interface is reachable.