Medium severity · published Aug 15, 2025
CVE-2025-9003
A vulnerability has been found in D-Link DIR-818LW 1.04
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-818lw Firmware · Dlink
1.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9003
Permissions Required
https://vuldb.com/?ctiid.320032
Third Party Advisory
https://vuldb.com/?id.320032
Third Party Advisory
https://vuldb.com/?submit.628334
Product
https://www.dlink.com/
More from Dir-818lw Firmware
9.8
CVE-2018-20114
On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an…
8.8
CVE-2019-13482
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01
8.8
CVE-2019-13481
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01
8.8
CVE-2019-12787
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA
8.8
CVE-2019-12786
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA