{"id":"CVE-2025-4901","published":"2025-05-18T23:31:04Z","modified":"2025-05-19T14:01:07Z","title":"D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosure","vendor":"D-Link","product":"DI-7003GV2","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-Link","product":"DI-7003GV2","versions":["24.04.18D1 R(68125)"]}],"description":{"text":"A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the file /H5/state_view.data of the component HTTP Endpoint. The manipulation leads to information disclosure. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the HTTP Endpoint component of the D-Link DI-7003GV2 (firmware 24.04.18D1 R(68125)) sits in the function sub_41E304, which handles the file /H5/state_view.data, and allows information disclosure. An attacker on the local network, with no authentication or user interaction required, can exploit it to read sensitive information exposed by that endpoint.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:43Z"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.78892,"percentile":0.99593,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://vuldb.com/?id.309457","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.309457","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.578049","tags":["third-party-advisory"]},{"url":"https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/state_view.md","tags":["exploit"]},{"url":"https://www.dlink.com/","tags":["product"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-15648","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15648","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/state_view.md"],"flow":[],"timeline":[{"date":"2025-05-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-4901","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":27.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9959"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.01,"detail":"base score 4.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}