CVE-2025-4443

CVE-2025-4443 is a command injection vulnerability in the function sub_454F2C of D-Link DIR-605L router firmware (build 2.13B01, classified under CWE-74/CWE-77). A remote attacker manipulates the 'sysCmd' argument of a request handled by this function to inject and execute arbitrary commands on the router; the CVSS 4.0 vector (AV:N/PR:L/UI:N) indicates a network vector requiring low privileges and no user interaction, with limited scored impacts on confidentiality, integrity and availability (VC:L/VI:L/VA:L), although the disclosure rates the issue as critical. Successful exploitation gives an attacker command execution on the device itself, which can serve as a foothold into the surrounding network. Only the DIR-605L is affected, and the source notes the flaw exists in a product that is no longer supported by D-Link (end-of-life); the vendor was contacted early about the disclosure. As of publication there is no known public proof-of-concept and the issue is not in CISA's KEV, but EPSS puts the probability of exploitation within 30 days at 56.8% (99th percentile), so exploitation attempts are considered likely.

What to do: Since the DIR-605L is end-of-life, no fixed firmware is confirmed in this disclosure — verify your current firmware build (2.13B01 is the referenced version) and check D-Link's support site for any final release before planning replacement. Until the router is retired, disable WAN-side remote management and UPnP and restrict the web management interface to trusted LAN clients. Given the 99th-percentile EPSS score, prioritize replacing or isolating these EOL devices rather than relying on a patch.