Information disclosure in D-Link Dsr-150

CVE-2025-60344

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.109 (95.7th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-60344: rose from 0.102 to 0.109.

EPSS over last 30 days · oldest: 0.102 · newest: 0.109 · change: +0.007

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-60344?
CVE-2025-60344 is a high-severity vulnerability in D-Link Dsr-150, classified under CWE-24. CVSS score: 8.6/10. Published 2025-10-21.
How severe is CVE-2025-60344?
High severity. CVSS v3 base score is 8.6 out of 10.