Description
D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://orenlab.sise.bgu.ac.il/publications/CrossRouter
Third Party Advisory x_refsource_misc
https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
Scores
CVSS v3
8.8
EPSS
0.0012
EPSS Percentile
30.1%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (1)
dlink/dir-825\/ac_g1_firmware
Published
Aug 27, 2019
Tracked Since
Feb 18, 2026