CVE-2025-4349

Deeper analysis

A critical command injection vulnerability, tracked as CVE-2025-4349, affects the D-Link DIR-600L wireless router in firmware versions up to 2.07B01. The flaw resides in the formSysCmd function, where improper handling of the host argument permits arbitrary command execution. The issue is remotely triggerable and carries a CVSS 4.0 score of 8.7; it impacts only end-of-life hardware that D-Link no longer maintains.

An authenticated attacker with network access can supply a crafted host parameter to the affected function, resulting in execution of operating-system commands on the device. Successful exploitation grants the attacker full control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as a pivot point into the local network.

No vendor patches or mitigation guidance are available because the product line is unsupported. Public references consist primarily of vulnerability disclosures on VulDB and a GitHub repository, with the manufacturer’s site providing no further remediation details.

The associated EPSS score has remained flat at 0.0533 since disclosure, indicating no material increase in observed exploitation interest.