CVE-2025-4348 is a high severity (CVSS 8.8) buffer overflow in the D-Link DIR-600L router, in the formSetWanL2TP function. D-Link no longer supports this model and the record lists no fixed firmware, so the practical answer is to retire the device or keep its admin interface unreachable.
What's affected
The record lists D-Link DIR-600L firmware up to and including 2.07B01. The affected code is the function formSetWanL2TP, and the weak input is the argument named host. The description adds that the vulnerability only affects products that are no longer supported by the maintainer.
The CVE record does not name a fixed firmware version, and I could not confirm one from a vendor advisory. Treat every DIR-600L on firmware 2.07B01 or older as affected, and check D-Link's support pages for the model before assuming a patch will ever arrive.
The router has many similar entries from the same research set. This one concerns formSetWanL2TP, and the safe assumption is that the whole admin interface is weak.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or tools page. If it shows 2.07B01 or earlier, the device is in the affected range.
Then find out who can reach the admin interface. From a machine on the LAN, check whether the router answers on its management address in a browser. From outside, check whether remote administration is enabled in the router settings, and whether any port forward points at the router itself.
For an estate rather than a single router, list every DIR-600L from your asset inventory, purchase records or DHCP leases. Small offices, branch sites and home workers' routers are the usual places this model survives.
What to do now
- Find every DIR-600L and note its firmware version.
- Replace each device with a model that still receives security updates. Because D-Link no longer supports this one, a patch should not be expected.
- Until it is replaced, switch off remote administration and make sure the admin page is not reachable from the internet or from guest Wi-Fi.
- Restrict the admin interface to one trusted wired host if the firmware allows it, and change any default or reused admin password.
- Put the router in a separate network segment from servers and sensitive workstations, and watch for unexpected reboots or configuration changes.
- Record the exception in your risk register with a replacement date, and check the D-Link advisory pages again before you close it.
Why it matters
The weakness is a memory safety error. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Classic Buffer Overflow) cover the case where a program copies input into a fixed size buffer without checking how long the input is. Here the input is the host argument handled by formSetWanL2TP. If the value is longer than the space reserved for it, the extra bytes overwrite neighbouring memory.
On routers, that memory often belongs to a web server process running with high privileges, so a successful overflow can crash the service at best and give an attacker control of the device at worst. The vector in the record lists network access, low complexity and low privileges required, which explains the 8.8 score. A login on the device is part of the scoring, and consumer routers often keep weak or default credentials.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. The risk is the combination of an unsupported product and a public write-up that points to specific functions. End of life network gear does not get quieter over time.
Quick check
Will D-Link release a patch for this?
The record says the product is no longer supported by the maintainer and lists no fixed version. Check the D-Link advisory pages to confirm, but plan on replacing the router rather than waiting.
Does turning off remote administration remove the risk?
It reduces it. The attack is described as remote, so closing internet access to the admin page helps a lot. Anyone who can still reach the interface from the LAN or guest Wi-Fi remains a possible source, so segmentation matters as well.
Sources
- Gold entry for CVE-2025-4348
- Public write-up referenced by the NVD record (formSetWanL2TP)
- VulDB entry 307466 referenced by the NVD record
- D-Link corporate site referenced by the NVD record
Last reviewed: 18 October 2026.
