CVE-2025-60344

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-21 · updated 2026-10-08
Weakness: CWE-24

Description

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.

Affected products

D-Link DSR-150: 1.09B32_WW

References

https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/
https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344

Get alerted when CVE-2025-60344 or the next vulnerability affects your stack