CVE-2025-45784 - D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials

Back Back to CVE browser

CRITICAL

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials

Published Jun 18, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 0.56%

Description

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (3)

https://cybermaya.in/posts/Post-37/
ExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28025
Advisory
https://www.dlink.com/en/security-bulletin/
Vendor Advisory

Link	Providers	Tags
https://cybermaya.in/posts/Post-37/		ExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28025		Advisory
https://www.dlink.com/en/security-bulletin/		Vendor Advisory