CVE-2025-4901

An information-disclosure flaw (CWE-200/CWE-284) exists in the D-Link DI-7003GV2 router running firmware 24.04.18D1 R(68125): the function sub_41E304 handling /H5/state_view.data in the device's HTTP endpoint mishandles requests and leaks information. An unauthenticated attacker who is already on the local network can trigger it by sending crafted requests to the router's web management interface (CVSS 4.0 reflects adjacent-network attack, no privileges, no user interaction). The attacker gains access to sensitive information exposed by that endpoint (low confidentiality impact); device integrity and availability are unaffected. Operators of DI-7003GV2 units with the affected firmware are affected, though only where the web interface is reachable from the local network. A public proof-of-concept is available; the flaw is not yet in CISA KEV, but a 77.3% EPSS probability (100th percentile) indicates a high likelihood of exploitation within 30 days.

What to do: Check the device's firmware version against 24.04.18D1 R(68125) and apply D-Link's fixed firmware once released (no fixed version is specified in current disclosures, so do not assume an upgrade target yet). Until patching, keep the web management interface off the WAN and restrict it to a trusted management VLAN or specific admin hosts, and segment guest/untrusted devices away from the router's LAN, since the flaw is only reachable locally. Given the public PoC and high EPSS, watch device logs for unexpected requests to /H5/state_view.data.