CVE-2025-4901

What it actually does

CVE-2025-4901 is an information disclosure vulnerability in the HTTP endpoint of D-Link DI-7003GV2 firmware version 24.04.18D1 R(68125), specifically involving the /H5/state_view.data handler. An attacker with network-level access to the device’s local management interface can manipulate requests to this endpoint to retrieve sensitive device or state information that should not be exposed. The flaw is limited to local-network exploitation, but routers and gateway devices commonly sit on trusted network segments where disclosed configuration, session, routing, or operational data can materially aid follow-on compromise.

Why it matters to the business

Successful exploitation can expose sensitive network or device information from an edge or gateway appliance, increasing the risk of unauthorized administrative access, network reconnaissance, lateral movement, and targeted attacks against internal systems. Because the exploit has been publicly disclosed and the EPSS score is elevated, organizations using the affected firmware should treat exposed management interfaces as high-risk even though the issue is not currently listed in CISA KEV and is not known to be used in ransomware campaigns.

How an attack unfolds

An attacker first gains access to the same local network segment as the affected D-Link DI-7003GV2 device, either through a compromised internal host, guest network exposure, VPN access, Wi-Fi access, or another foothold. The attacker identifies the device’s HTTP management service and sends crafted requests to the /H5/state_view.data endpoint. Due to improper handling in the vulnerable HTTP endpoint logic, the device returns information that should not be available to the requester. The attacker can then use the disclosed data to map the network, identify configuration details, support credential or session-targeting activity, or prepare additional attacks against the router or adjacent systems.

How to fix it

Upgrade the D-Link DI-7003GV2 firmware to a vendor-provided fixed release when available. No fixed version was provided in the supplied advisory data, so administrators should check D-Link support channels for firmware newer than 24.04.18D1 R(68125) and apply it after testing. Until a fix is available, restrict access to the device management interface to a dedicated administrative VLAN or jump host, block untrusted local-network clients from reaching the HTTP service, disable remote or unnecessary management services, require strong administrative credentials, and monitor for access to /H5/state_view.data. If the device cannot be updated or isolated, consider replacing it with a supported model.

How to confirm the fix worked

Confirm the device model and firmware version through the administrative interface or asset inventory and verify that no DI-7003GV2 device remains on firmware 24.04.18D1 R(68125). Validate that the HTTP management interface is reachable only from approved administrative networks and not from guest, user, VPN, or wireless client segments. Review firewall or ACL rules to ensure access to TCP web-management ports is restricted. After remediation, test that unauthenticated or low-privileged requests to /H5/state_view.data no longer return sensitive information. Where firmware logging is limited, validate exposure using network scans and management-plane access tests from representative internal network segments.

Typical attack path

1. Obtain access to the local network where the D-Link DI-7003GV2 management interface is reachable.
2. Scan or enumerate internal IP addresses for D-Link router HTTP management services.
3. Send crafted HTTP requests to /H5/state_view.data on the affected device.
4. Collect sensitive information returned by the vulnerable endpoint.
5. Use the disclosed information for reconnaissance, privilege escalation attempts, administrative interface attacks, or lateral movement.

How to detect it

Look for evidence of local-network clients requesting the vulnerable HTTP endpoint on D-Link DI-7003GV2 devices. Useful log sources include router HTTP/access logs if available, firewall logs, internal web proxy logs, IDS/IPS alerts, NetFlow records, packet captures, NAC telemetry, and EDR telemetry from internal hosts that may have issued HTTP requests to the router. Prioritize requests to /H5/state_view.data from user workstations, guest wireless clients, VPN-assigned addresses, unknown devices, or any source outside normal network administration ranges. Because exploitation may only require a simple HTTP request, there may be few artifacts beyond management-plane network traffic. If suspicious requests are found, review surrounding activity for internal scanning, repeated HTTP enumeration of router paths, authentication attempts to the administrative interface, configuration downloads, and subsequent lateral movement from the same source host.

• /H5/state_view.data
• GET /H5/state_view.data
• POST /H5/state_view.data
• http.request.uri contains "/H5/state_view.data"
• http.request.full_uri contains "/H5/state_view.data"
• D-Link DI-7003GV2
• 24.04.18D1 R(68125)

What your security team should do

• Immediately inventory D-Link DI-7003GV2 devices and identify any running firmware 24.04.18D1 R(68125).
• Restrict management interface access to trusted administrative hosts or a dedicated management VLAN.
• Search proxy, firewall, IDS, and device logs for requests to /H5/state_view.data, especially from non-administrative client IPs.
• Apply vendor firmware updates as soon as a fixed version is available; if no fix is available, maintain compensating controls or replace the device.
• Treat unexpected access to the endpoint as suspicious because public exploit details are available and EPSS indicates a meaningful likelihood of exploitation.
• Review exposed network information and rotate administrative credentials if exploitation is suspected.
• Segment guest, wireless, VPN, and general user networks away from router management interfaces.