Path Traversal in D-Link Dsl-2730u
CVE-2025-34048
A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.007 (50.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- D-Link Dsl-2730u — versions IN_1.02
- D-Link Dsl-2750e — versions SEA_1.04, SEA_1.07
- D-Link Dsl-2750u — versions SEA_1.04, SEA_1.07
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/40735 (exploit)
- github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/route… (exploit)
- www.dlink.com (product)
- vulncheck.com/advisories/dlink-dsl-routers-path-traversal-file-read (third-party-advisory)