CVE-2025-2360 is a high severity improper authorization flaw (CVSS 7.3) in the D-Link DIR-823G router, firmware 1.0.2B05_20181207, in the UPnP service. The product is no longer supported, so no patch is expected. Replace the device, and until then turn off remote management and UPnP.
What's affected
The NVD record names the D-Link DIR-823G with firmware 1.0.2B05_20181207. The affected code is the function SetUpnpSettings in the /HNAP1/ handler of the UPnP service, where the SOAPAction argument leads to improper authorization. In plain terms, a request can reach an action that should have checked who is asking.
The description says the exploit has been disclosed to the public and may be used. It also says the product only affects devices that are no longer supported by the maintainer. The record is not on the CISA Known Exploited Vulnerabilities list.
The weaknesses are classed as CWE-266 (incorrect privilege assignment) and CWE-285 (improper authorization). The score is 7.3 (HIGH). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is limited on confidentiality, limited on integrity and limited on availability. The record was published on 2025-03-17.
There is no fixed version. Because the maintainer no longer supports this model, waiting for a patch is not a plan. The practical fix is to retire the router and move to a supported model.
How to check if you're exposed
Start with what you own. Routers are easy to forget once they are plugged in.
- Look at the label on the device for the model name DIR-823G, then open the admin page and read the firmware version on the status screen. Compare it with 1.0.2B05_20181207.
- Check whether the admin interface is open to the internet. From a machine outside your network, scan your own public address for the common web admin ports.
nmap -Pn -p 80,443,8080,8443 YOUR.PUBLIC.IP.ADDRESS
- In the router settings, see whether UPnP is switched on and whether remote management is enabled.
- If you manage many sites, search your asset list for the model name, since this is the kind of device that sits in branch offices and home offices unnoticed.
Only scan addresses you own or have permission to test.
What to do now
- Replace the DIR-823G with a model that still receives security updates.
- Until it is replaced, turn off remote management so the admin interface is not reachable from the internet.
- Disable UPnP on the router unless something on your network truly needs it.
- Put the router on its own segment if you can, so a compromised device cannot reach sensitive machines easily.
- Change the admin password from any default and record the replacement date in your asset register.
Why it matters
The weakness is classed as CWE-266 and CWE-285. Both describe the same idea: the device lets a caller do something without checking that the caller is allowed to. On a router the stakes are higher than on most software, because the device sits between your network and the internet and sees all the traffic.
End of support is the larger story here. Once a vendor stops shipping fixes, every new finding stays open forever. A vector with no privileges and no user interaction, a public exploit write-up and no patch is a poor combination, and retiring the hardware is the clean answer.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Is there a patch for CVE-2025-2360?
The record gives no fixed version and says the product is no longer supported by the maintainer. Plan to replace the router instead of waiting for an update.
Does turning off UPnP remove the risk?
It may reduce exposure, but the record does not say it is a complete workaround. Treat it as a way to shrink the attack surface while you replace the device.
Sources
- Safeguard Gold entry for CVE-2025-2360
- NVD record data for CVE-2025-2360 (published 2025-03-17)
- D-Link
Last reviewed: 19 October 2026.
