DIR-803 - Information Disclosure (CVE-2025-14528)

CVE-2025-14528 is an information disclosure vulnerability in D-Link DIR-803 routers up to firmware version 1.04, specifically within the /getcfg.php configuration handler. By manipulating the AUTHORIZED_GROUP argument, remote attackers can exploit this flaw to access sensitive configuration data without authentication. The exploit is publicly available, increasing the risk of unauthorized data exposure, especially since these devices are no longer supported by the vendor.

CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-14528 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec network telemetry also shows that exploitation of CVE-2025-14528 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /getcfg.php endpoint by injecting newline characters and manipulating the AUTHORIZED_GROUP parameter to bypass authentication and retrieve sensitive XML configuration data, including administrator credentials.