CVE-2025-4443 is a medium severity command injection in the D-Link DIR-605L router, firmware 2.13B01, in the sub_454F2C function through the sysCmd argument. D-Link no longer supports this model, so no fix is expected. Retire the device, or take its management interface off the network.
What's affected
- Product: D-Link DIR-605L router and its firmware.
- Affected: firmware 2.13B01 is named in the record.
- Fixed version: none. The record says the product is no longer supported by the maintainer, and the vendor was contacted early about the disclosure.
- Location:
sub_454F2C, through thesysCmdargument. - Severity: CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), rated Medium.
How to check if you're exposed
Firmware cannot be scanned like a package, so start with the device itself.
- Find the model and firmware version on the router's status page, or on the label on the underside of the device.
- If it says DIR-605L and the firmware matches 2.13B01, it is in the affected set.
- Find out whether the web management interface is reachable from the internet or from guest networks. Many routers expose it on the WAN side only when remote management is switched on.
# from outside your network, does the router answer on its management ports?
nc -vz your-public-ip 80
nc -vz your-public-ip 8080
An answer from the internet means the interface is exposed. Keep a list of every end of life router in your estate, including those at small branches and home offices.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers software dependencies, not router firmware, so use it for the applications you run and keep a manual list for network devices.
What to do now
- Replace the DIR-605L with a router that still receives security updates. This is the only complete fix.
- Switch off remote management on the WAN side today, and restrict the web interface to a single wired management address.
- Change the administrator password to a long unique one, and disable any guest or default accounts.
- Put the router in a separate network segment from sensitive systems until it is replaced.
- Add the device to your asset inventory as end of life, with a replacement date, so it does not return to the shelf.
Why it matters
The weakness is CWE-77, improper neutralization of special elements used in a command, within the broader CWE-74, injection. The sub_454F2C code passes the value of sysCmd into a system command without cleaning it, so the router's shell may treat part of that value as a command. On a router, the shell runs with high privileges.
The score of 6.3 reflects network access with low privileges required. The larger issue is the lifecycle. The record says the model is no longer supported, so there is no patch to wait for. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Quick check
Will D-Link release a fix?
The record says the product is no longer supported by the maintainer. Check the D-Link support page for your model, but plan for replacement.
Is turning off remote management enough?
It lowers exposure from the internet, but anyone on the local network can still reach the interface. Replacement is the real fix.
Sources
Last reviewed: 18 October 2026.
