CVE-2019-15655: D-Link DSL-2875al Firmware

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.

Affected products

• D-Link DSL-2875al Firmware: up to and including 1.00.05

Published 2020-03-19. Last modified 2026-06-17.