CVE-2025-60344

Published: Oct 21, 2025

Modified: Feb 27, 2026

PUBLISHED

CVSS v3.1

8.6

HIGH

Description

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.

Vendor	Product	Versions
D-Link	DSR-150	affected `1.09B32_WW`

Weaknesses (CWE)

CWE-24

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

References

https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/

https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now