Last week, the CrowdSec Network added a detection rule for CVE-2025-14528, a vulnerability in old D-LINK routers. In this week’s threat alert, we dive into how this vulnerability works, how attackers exploit it, and what makes vulnerabilities in routers such a particularly interesting target for low-level cybercriminals.
Key findings
CVE-2025-14528 was published on December 11, 2025, and CrowdSec released a detection rule on February 18, 2026. Active exploitation of CVE-2025-14528 was observed starting February 20, 2026.
CVE-2025-14528 originates from a lack of access controls to a PHP script running on the router. It allows attackers to read the admin account and password from the local filesystem, enabling further compromise.
Remote router exploits such as CVE-2025-14528 are often used to build botnets. CrowdSec will continue monitoring this vulnerability to see if this happens for CVE-2025-14528.
How does CVE-2025-14528 work?
This vulnerability lies in the /getcfg.php component of the router’s firmware. By actively manipulating the AUTHORIZED_GROUP argument and injecting newline characters, an unauthenticated remote attacker can bypass security checks.
Successful exploitation grants the attacker access to the device’s sensitive configuration data in XML format. In particular, the AUTHORIZED_GROUP header will reveal the contents of the local credential storage. This causes the router to send the admin account and password back to the remote attacker in cleartext.
...
