CVE-2025-4443: D-Link DIR-605L sysCmd argument command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw is a critical-rated command injection with high EPSS, but exploitation requires low privileges and the affected product is end-of-life with no patch, limiting practical remediation.

What it is

The D-Link DIR-605L firmware 2.13B01 contains a command injection flaw in the function sub_454F2C, where manipulation of the sysCmd argument allows injected commands to execute. The vendor was contacted and notes the product is no longer supported, so no fix is expected. Because the device is end-of-life, exposed units will remain vulnerable indefinitely.

Impact

An attacker who can reach the vulnerable function can execute arbitrary commands on the router, potentially gaining control of the device and its network traffic. The CVSS 4.0 vector rates confidentiality, integrity and availability impact as low.

Attack surface

The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but the vector indicates low privileges (PR:L) are required, meaning some form of authenticated or otherwise privileged access is needed to reach the vulnerable function.

Exploitation

No public exploitation is confirmed: the CVE is not in CISA KEV, no ransomware usage is documented, and the primary reference is tagged as a broken link, though EPSS is high at 0.576 (99th percentile).

What to do

• Replace the end-of-life DIR-605L with a supported router, since D-Link no longer maintains this product and no patch is expected.
• If the device must remain in service, isolate it on a separate network segment and block management/HTTP access from untrusted networks.
• Restrict administrative access to trusted hosts and change default credentials.
• Monitor vendor and advisory channels for any unsupported end-of-life guidance or interim workarounds.

Detection

• Inspect router logs and network traffic for unusual or shell-like characters in requests to the management interface.
• Monitor for unexpected outbound connections or processes originating from the router.
• Alert on access to the management interface from untrusted source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.