CVE-2025-4901: D-Link DI-7003GV2 HTTP endpoint information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityLocal-network-only information disclosure with low confidentiality impact, but a public exploit and very high EPSS score raise the urgency for exposed devices.

What it is

The HTTP endpoint /H5/state_view.data in D-Link DI-7003GV2 firmware 24.04.18D1 R(68125) exposes information through the sub_41E304 function without proper access control. The flaw is reachable only from the local network, and a public exploit has been disclosed. It matters because sensitive device state data can be read by anyone on the same LAN segment.

Impact

An attacker on the local network gains read access to information exposed by the state_view endpoint. The CVSS vector shows only confidentiality impact (VC:L) with no integrity or availability effect.

Attack surface

Reached over the adjacent network via the HTTP endpoint /H5/state_view.data; the vector indicates no privileges (PR:N) and no user interaction (UI:N) are required. The description states the attack can only be done within the local network.

Exploitation

A public exploit reference exists (GitHub advisory tagged Exploit), but the CVE is not in CISA KEV and no ransomware use is documented. EPSS is 0.77288 (99.5th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the latest firmware from D-Link for DI-7003GV2; if no fix is available, contact D-Link support for guidance.
• Restrict local network access to the device management interface and segment IoT/edge devices from user networks.
• Block or monitor access to /H5/state_view.data at the network boundary where feasible.
• Change default credentials and disable remote management features not in use.
• Monitor D-Link advisories for a patched firmware release.

Detection

• Monitor HTTP requests to /H5/state_view.data on the local network for unexpected or repeated access.
• Alert on access to the device management interface from hosts other than authorized admin stations.
• Review device logs for anomalous reads of state or configuration endpoints.
• Track network scans or enumeration activity targeting D-Link DI-7003GV2 devices on the LAN.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.