This vulnerability (CVE-2025-34048) affects D-Link DSL-2730U, DSL-2750U, and DSL-2750E routers running firmware versions IN_1.02, SEA_1.04, and SEA_1.07. It is caused by improper limitation of a pathname (CWE-22) due to insufficient input validation on the getpage parameter in the /cgi-bin/webproc CGI script. An unauthenticated remote attacker can exploit this flaw by crafting requests that perform path traversal, enabling arbitrary file reads on the affected device. The CVSS 4.0 base score is 8.7, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality. Exploitation evidence was observed on 2025-02-04 UTC. There is no indication of an official patch or vendor advisory at this time.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on affected D-Link routers, potentially exposing sensitive configuration or system files. This compromises device confidentiality and may facilitate further attacks or information disclosure. The vulnerability has a high severity rating (CVSS 8.7) due to its remote, unauthenticated nature and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the router's web management interface from untrusted networks and monitor for unusual access patterns. Do not expose the management interface directly to the internet. Follow vendor channels for updates regarding patches or official mitigations.