Dingtian DT-R0 Series Authentication Bypass Using an Alternate Path or Channel
Priority MEDIUM 49CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00591 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dingtian | DT-R002 | V3.1.3044A | — | No fix listed | CNA |
| Dingtian | DT-R008 | V3.1.1759A | — | No fix listed | CNA |
| Dingtian | DT-R016 | V3.1.2776A | — | No fix listed | CNA |
| Dingtian | DT-R032 | V3.1.3826A | — | No fix listed | CNA |
- DT-R002 VendorDingtian Affected V3.1.3044A Fixed in — No fix listed CNA
- DT-R008 VendorDingtian Affected V3.1.1759A Fixed in — No fix listed CNA
- DT-R016 VendorDingtian Affected V3.1.2776A Fixed in — No fix listed CNA
- DT-R032 VendorDingtian Affected V3.1.3826A Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dingtian-tech:dt-r002_firmware:3.1.3044a:*:*:*:*:*:*:* | 3.1.3044a | Vulnerable | Dingtian |
| cpe:2.3:h:dingtian-tech:dt-r002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dingtian |
| cpe:2.3:o:dingtian-tech:dt-r008_firmware:3.1.1759a:*:*:*:*:*:*:* | 3.1.1759a | Vulnerable | Dingtian |
| cpe:2.3:h:dingtian-tech:dt-r008:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dingtian |
| cpe:2.3:o:dingtian-tech:dt-r016_firmware:3.1.2776a:*:*:*:*:*:*:* | 3.1.2776a | Vulnerable | Dingtian |
| cpe:2.3:h:dingtian-tech:dt-r016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dingtian |
| cpe:2.3:o:dingtian-tech:dt-r032_firmware:3.1.3826a:*:*:*:*:*:*:* | 3.1.3826a | Vulnerable | Dingtian |
| cpe:2.3:h:dingtian-tech:dt-r032:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dingtian |
- cpe:2.3:o:dingtian-tech:dt-r002_firmware:3.1.3044a:*:*:*:*:*:*:* Versions 3.1.3044a Vulnerable ·Dingtian
- cpe:2.3:h:dingtian-tech:dt-r002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dingtian
- cpe:2.3:o:dingtian-tech:dt-r008_firmware:3.1.1759a:*:*:*:*:*:*:* Versions 3.1.1759a Vulnerable ·Dingtian
- cpe:2.3:h:dingtian-tech:dt-r008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dingtian
- cpe:2.3:o:dingtian-tech:dt-r016_firmware:3.1.2776a:*:*:*:*:*:*:* Versions 3.1.2776a Vulnerable ·Dingtian
- cpe:2.3:h:dingtian-tech:dt-r016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dingtian
- cpe:2.3:o:dingtian-tech:dt-r032_firmware:3.1.3826a:*:*:*:*:*:*:* Versions 3.1.3826a Vulnerable ·Dingtian
- cpe:2.3:h:dingtian-tech:dt-r032:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dingtian
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1283
- 2026-10-03 Alias added: GHSA-gccq-88r2-w9m4
References
More Dingtian Dt-r002 Firmware vulnerabilities
- TI-2025-09963 Insufficiently Protected Credentials in Dingtian DT-R002 CVSS 4.0HIGH 8.7
- TI-2025-09962 Insufficiently Protected Credentials in Dingtian DT-R002 CVSS 4.0HIGH 8.7
Sources
- CVE-2025-1283 · CVE Program
- CVE-2025-1283 · NVD
- FIRST EPSS
- GHSA-gccq-88r2-w9m4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences