CVE-2025-4349 is a high severity (CVSS 8.8) command injection flaw in the D-Link DIR-600L router, in the formSysCmd function. The model is no longer supported by D-Link and the record lists no fixed firmware, so the practical answer is to retire the router or keep its admin interface unreachable.
What's affected
The record lists D-Link DIR-600L firmware up to and including 2.07B01. The affected function is formSysCmd, and the description names the argument as host, although the public write-up linked from the record names the parameter sysCmd. The record also states that the product is no longer supported by the maintainer.
No fixed firmware version appears in the record, and I could not confirm one from a vendor advisory. Assume that all DIR-600L units on 2.07B01 or older are affected, and read D-Link's support pages for the model for any final notice.
How to check if you're exposed
Log in to the router admin page and read the firmware version. Version 2.07B01 or earlier is in the affected range.
Next, check exposure. Confirm that remote management is switched off, that no port forward exposes the router's own web interface, and that guest Wi-Fi cannot reach the admin address. The record describes the attack as remote, so anything that makes the interface reachable widens the risk.
If you manage many sites, use your asset list, DHCP leases or network scans of your own ranges to find every DIR-600L. Look at remote offices and home worker kit, which tend to be missed in refresh cycles.
What to do now
- Identify every DIR-600L and its firmware version.
- Replace the router with a supported model. D-Link no longer maintains this one.
- Until replacement, turn off remote administration and any dynamic DNS or port forward that points at the router.
- Limit admin access to a single trusted wired machine where the firmware allows it, and set a strong, unique admin password.
- Segment the device away from servers and sensitive workstations, and review its configuration for changes you did not make.
- Log the exception with an owner and a replacement date.
Why it matters
The class is injection. CWE-74 (Injection) and CWE-77 (Command Injection) describe the case where input is placed into a command or query without neutralising special characters. Here the value reaches a system command through formSysCmd, so a crafted value can add commands of its own. The record does not give more detail than that, and this post does not either, because the useful point for defenders is where to look and what to remove.
Router firmware usually runs its web server with high privileges, so command execution on the device generally means control of it. Control of the gateway lets an attacker watch traffic, change DNS answers and reach other devices on the network. The record scores it 8.8, with network access, low complexity and low privileges required. A login to the device is part of that scoring.
The flaw is not marked as exploited in the wild and is not on the CISA Known Exploited Vulnerabilities list. Because the model is unsupported, though, there is no vendor fix to wait for. That is what makes this a replacement decision rather than a patching decision.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a firmware update that fixes this?
The record lists none and says the product is no longer supported. Check D-Link's advisory pages to confirm, and plan to replace the router.
Is this exploited in the wild?
The record does not say so, and the CVE is not on the CISA Known Exploited Vulnerabilities list. That does not make it safe to leave in place.
Sources
- Gold entry for CVE-2025-4349
- Public write-up referenced by the NVD record (formSysCmd)
- VulDB entry 307467 referenced by the NVD record
Last reviewed: 18 October 2026.
