High severity8.8NVD Advisory· Published May 6, 2025· Updated Jun 17, 2026

CVE-2025-4349

Description

A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dlink/DIR-600cpe-rescue
Range: 2.07B01
Dlink/Dir 600l Firmware
cpe:2.3:o:dlink:dir-600l_firmware:*:*:*:*:*:*:*:*
Range: <=2.07b01
Dlink/DIR600Lllm-create
Range: <=2.07B01

Patches

Vulnerability mechanics

References

github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Command_injection-formSysCmd-sysCmd/README.mdnvdBroken LinkThird Party Advisory
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions Required
www.dlink.comnvdProduct

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

8.8/ 10

CVSS v48.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

3.76%

VYPR risk score

Composite of severity, exploitation, and reach.

0.58high

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE ID

CVE-2025-4349

Credits

B(
B1Nn (VulDB User)
reporter