CVE-2025-4442 is a high severity buffer overflow in the D-Link DIR-605L router, firmware 2.13B01, in the formSetWAN_Wizard55 function through the curTime argument. D-Link no longer supports this model, so no fix is expected. Retire the device, or take its management interface off the network.
What's affected
- Product: D-Link DIR-605L router and its firmware.
- Affected: firmware 2.13B01 is named in the record.
- Fixed version: none. The record says the product is no longer supported by the maintainer, and the vendor was contacted early about the disclosure.
- Location:
formSetWAN_Wizard55, through thecurTimeargument. - Severity: CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated High.
How to check if you're exposed
Firmware cannot be scanned like a package, so start with the device itself.
- Find the model and firmware version on the router's status page, or on the label on the underside of the device.
- If it says DIR-605L and the firmware matches 2.13B01, it is in the affected set.
- Find out whether the web management interface is reachable from the internet or from guest networks. Many routers expose it on the WAN side only when remote management is switched on.
# from outside your network, does the router answer on its management ports?
nc -vz your-public-ip 80
nc -vz your-public-ip 8080
An answer from the internet means the interface is exposed. Keep a list of every end of life router in your estate, including those at small branches and home offices.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers software dependencies, not router firmware, so use it for the applications you run and keep a manual list for network devices.
What to do now
- Replace the DIR-605L with a router that still receives security updates. This is the only complete fix.
- Switch off remote management on the WAN side today, and restrict the web interface to a single wired management address.
- Change the administrator password to a long unique one, and disable any guest or default accounts.
- Put the router in a separate network segment from sensitive systems until it is replaced.
- Add the device to your asset inventory as end of life, with a replacement date, so it does not return to the shelf.
Why it matters
The weakness is CWE-119, improper restriction of operations within the bounds of a memory buffer, in its common form CWE-120, copying input without checking its size. The formSetWAN_Wizard55 handler copies the value of curTime into a fixed size buffer without limiting the length, so an oversized value can overwrite adjacent memory. On a router, that can crash the web service or, in the worst case, lead to code execution.
The score of 8.8 reflects network access with low privileges required. The larger issue is the lifecycle. The record says the model is no longer supported, so there is no patch to wait for, and the same router is likely to collect further findings. A cluster of similar overflow reports in the same product line suggests the web handlers share the same unsafe pattern. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Quick check
Will D-Link release a fix?
The record says the product is no longer supported by the maintainer. Check the D-Link support page for your model, but plan for replacement.
Is turning off remote management enough?
It lowers exposure from the internet, but anyone on the local network can still reach the interface. Replacement is the real fix.
Sources
Last reviewed: 18 October 2026.
