CVE-2015-7245: D-Link DVG-N5402SP router path traversal in errorpage parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote file read on an internet-facing gateway with public exploit code and very high EPSS, though no KEV listing or ransomware use is documented.

What it is

The D-Link DVG-N5402SP gateway firmware (W1000CN-00, W1000CN-03, W2000EN-00) contains a directory traversal flaw in the errorpage parameter, allowing a remote attacker to read files outside the intended web root. Because the device is a network edge gateway, exposed file contents can include sensitive configuration and credential material.

Impact

An unauthenticated remote attacker can read arbitrary files on the device, exposing sensitive information such as configuration data and credentials. This is confidentiality-only; there is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via the web interface with no authentication and no user interaction required (AV:N/PR:N/UI:N). The traversal is triggered by supplying a .. sequence in the errorpage parameter.

Exploitation

Public exploit code exists (Exploit-DB 39409, Packet Storm, Full Disclosure) and EPSS is 0.45479 (98.7th percentile), indicating high likelihood of attempted exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the latest D-Link firmware for the DVG-N5402SP; if no fixed firmware exists, replace or retire the device.
• Restrict management/web interface access to trusted networks and never expose it to the internet.
• Filter or reject requests containing traversal sequences (../, ..\) in the errorpage parameter at a reverse proxy or WAF.
• Monitor vendor advisories for end-of-life status and plan device replacement if unsupported.

Detection

• Inspect web logs for requests to the errorpage parameter containing ../ or encoded traversal sequences.
• Alert on HTTP responses returning file contents or unexpected paths from the device's web interface.
• Monitor outbound traffic from the device to untrusted hosts for signs of data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.