CVE-2025-4443
Published: 09 May 2025
Summary
CVE-2025-4443 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dir-605L Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability rated critical exists in the D-Link DIR-605L wireless router running firmware version 2.13B01. It resides in the sub_454F2C function, where improper handling of the sysCmd argument permits command injection. The flaw is tracked under CWE-74 and CWE-77, carries a CVSS 4.0 score of 5.3 reflecting network attack vector and low-privilege requirements, and affects only an end-of-support product line.
An authenticated remote attacker can supply a crafted sysCmd value to execute arbitrary operating-system commands on the device. Successful exploitation yields limited read, write, and disruption capabilities on the router itself without needing user interaction or elevated privileges.
Public references include a detailed disclosure on GitHub, multiple Vuldb entries, and the vendor’s site. The maintainer was notified prior to publication but provides no patches or ongoing support for the affected hardware.
EPSS remains flat at 0.0174 with no material increase after disclosure, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14058
Vulnerability details
A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. The vendor was contacted…
more
early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web parameter (sysCmd/host) in public-facing router web interface enables exploitation of public-facing application (T1190), indirect command execution (T1202), and network device CLI abuse (T1059.008).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.