Medium severity · published Aug 15, 2025
CVE-2025-9003
D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scripting
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DIR-818LW · D-Link
1.04 · source: vendor
DF
Dir-818lw Firmware · Dlink
1.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9003
Permissions Required
https://vuldb.com/?ctiid.320032
Third Party Advisory
https://vuldb.com/?id.320032
Third Party Advisory
https://vuldb.com/?submit.628334
Product
https://www.dlink.com/
More from DIR-818LW
7.2
CVE-2025-7553
D-Link DIR-818LW System Time Page os command injection