CVE-2025-1283 is a critical authentication bypass (CVSS 9.8) in the Dingtian DT-R0 series of networked devices. Per CISA, Dingtian has not responded about a fix, so no mitigation is available. Keep the devices off the internet and behind a VPN.
What's affected
CISA's advisory ICSA-25-044-18 lists these versions of the DT-R0 series as affected:
- DT-R002: V3.1.3044A
- DT-R008: V3.1.1759A
- DT-R016: V3.1.2776A
- DT-R032: V3.1.3826A
The record also lists the matching firmware for the DT-R002, DT-R008, DT-R016 and DT-R032 models. The flaw lets attackers bypass login requirements by navigating directly to the main page. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, no privileges, no user interaction, and high impact on all three measures. CISA also calculated a CVSS v4 score of 9.3.
There is no fix to point to. CISA's advisory says Dingtian has not responded to requests to work with CISA to mitigate the vulnerability, and that users of affected versions of the DT-R002 are invited to contact Dingtian customer support.
How to check if you're exposed
- Make a list of every Dingtian DT-R0 device in use, including ones installed by contractors or building systems vendors.
- Read the firmware version from each device's web page and compare it with the list above.
- Check whether any device can be reached from the internet, directly or through port forwarding. A quick search of your external address ranges for open web ports on the device network helps.
- Check whether the devices sit on the same network as office computers, cameras or other control systems.
These devices have no package manifest, so dependency scanning does not apply. The free in-browser scan covers your software supply chain, and the Gold page for CVE-2025-1283 tracks the record.
What to do now
- Remove every Dingtian DT-R0 device from direct internet access. This matters more than anything else on this list.
- Where remote access is required, use a VPN, as CISA recommends. Keep the VPN software updated, because it is only as strong as the connected devices.
- Place the devices on a separate network segment with firewall rules that allow only the systems that need to talk to them.
- Contact Dingtian support for the affected models, as CISA suggests, and ask whether a fixed firmware exists. Record the answer.
- Review what the devices control. If the loads are safety related, add a physical safeguard that does not depend on the network.
- Follow CISA's defence in depth guidance for control systems.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
The record classifies the problem as CWE-288, authentication bypass using an alternate path, and CWE-306, missing authentication for a critical function. In simple terms, the login page is there, but the main page works without going through it. Authentication that can be skipped is not authentication.
If the devices switch real equipment, a control page that anyone can reach is more than an information problem. With no vendor fix, network controls are the only defence. The record does not flag CVE-2025-1283 as a CISA Known Exploited Vulnerability. It is listed in a CISA ICS advisory, which is a different thing from the KEV catalogue, and nothing in the advisory claims exploitation.
Quick check
Is there a patch for the Dingtian DT-R0 series?
CISA says Dingtian has not responded to requests to work on a mitigation, so none is available. Contact Dingtian support and check for updates.
What does CISA recommend in the meantime?
Minimise network exposure, keep control devices off the internet, and use a VPN for remote access, keeping the VPN updated.
Sources
Last reviewed: 19 October 2026.
