D-Link DIR-605 CVE-2025-14884
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router admin interface
-
DeliveryAuthenticate with weak/default credentials
-
ExploitSend crafted request to Firmware Update Service
-
ExecutionInject shell metacharacters into command
-
PersistExecute arbitrary commands on device
-
ImpactFull router compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires reachability of the D-Link DIR-605 (firmware 2.02WW/202WWB03) administrative interface and, per the CVSS PR:H metric, high-privilege (authenticated admin) access to invoke the Firmware Update Service - in practice this means an attacker with valid/default/weak admin credentials or an exposed management interface. The command injection is triggered by passing shell metacharacters through a parameter of the Firmware Update Service that is handled unsanitized. Limiting factors: this is an end-of-life product (no patch available, so only devices still in service are at risk), exploitation hinges on the attacker holding admin privileges (PR:H), and no user interaction is required (UI:N). A public POC exists, reducing attacker effort. |
| Impact | Signals are mixed but lean toward meaningful risk. The CVSS 4.0 base score is 7.3 (HIGH) with network vector (AV:N), low complexity (AC:L), and full VC:H/VI:H/VA:H impact - consistent with command injection granting full device compromise. However the vector specifies PR:H, indicating the attacker must already hold high privileges (typically authenticated admin on the router web interface), which materially tempers the 'attack can be initiated remotely' language in the description. The strongest escalating signal is EPSS at 10.96% (96th percentile), unusually high and reflecting both public POC availability and the commodity nature of D-Link router exploitation. POC is publicly available (cna@vuldb.com submission with a Notion writeup), so weaponization is low-effort, but this is NOT the same as active exploitation - the CVE is not in CISA KEV. Net: a real, prioritizable issue for anyone still running this hardware, but the PR:H precondition and the product's end-of-life status (no patch forthcoming) mean practical risk centers on exposed/credential-weak devices rather than untargeted mass exploitation. Note the PR:H in the CVSS vector conflicts somewhat with the 'remotely' framing - the realistic path is a remotely reachable admin interface with known/default/weak credentials. |
| Exploit ScenarioDerived | An attacker with access to the DIR-605 administrative web interface (e.g., via default or weak credentials, or an exposed WAN-side management port) sends a crafted request to the Firmware Update Service endpoint, embedding shell metacharacters in a parameter that is passed unsanitized to a system command. This yields arbitrary command execution on the router with device privileges, enabling full takeover. A public POC with reproduction steps already exists (published Notion writeup linked from NVD), lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Command injection in the Firmware Update Service of the end-of-life D-Link DIR-605 router running firmware 202WWB03 (2.02WW) lets an attacker who holds administrative access to the device's management interface inject and execute arbitrary shell commands on the underlying firmware. Exploitation requires high-privilege access per the CVSS PR:H metric - in practice valid, default, or weak admin credentials, or an admin interface exposed to an untrusted network - and no user interaction is needed. Publicly available exploit code exists (a detailed proof-of-concept writeup is already circulating), and EPSS stands at 10.96% (96th percentile), indicating elevated real-world likelihood; there is no confirmed active exploitation (CISA KEV) at time of analysis, and because the product is no longer supported by D-Link, no vendor patch is expected.
RemediationAI
No vendor-released patch identified at time of analysis: the DIR-605 is end-of-life and D-Link has published no fixed firmware for the Firmware Update Service flaw, so the primary remediation is replacement with a currently supported router or access point - a hard cutover, but the only measure that fully removes the exposure. If the device must remain in service short-term, apply layered compensating controls that directly address the PR:H prerequisite and the network reachability of the update functionality: immediately change any default or re-used administrator credentials, restrict the management interface so it is reachable only from a trusted LAN/VLAN or a specific management host (blocking WAN-side and internet-facing admin access, and disabling remote management), and never expose the router's HTTP/HTTPS admin port through port forwarding, UPnP, or DMZ rules. Trade-offs: strictly scoping management access to trusted hosts breaks remote administration and may disrupt NAT/port-forward management workflows; disabling remote management means on-site or VPN access is required for configuration changes. Network segmentation placing the DIR-605 on an isolated IoT VLAN limits lateral movement if it is compromised, but does not prevent the command injection itself on a device the attacker can already reach with admin rights, and log monitoring for anomalous POST requests to the firmware-update endpoint is a detective control only. Given publicly available exploit code and an EPSS score of 10.96% (96th percentile), prioritize inventorying any remaining DIR-605 units still running 202WWB03 and decommissioning them rather than relying on configuration hardening alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Firmware Update Service of D-Link DIR-605 firmware version 202WWB03 (tracked as CPE cpe:2.3:o:dlink:dir-605_firmware:2.02ww, also described as B1 v202WWB03). Root cause is CWE-74, neutralization of special elements in output used by a downstream component - specifically, a parameter passed to the firmware-update routine is not sanitized before being handed to a shell, so shell metacharacters embedded in the request are interpreted as commands and executed with the privileges of the update service (typically root on embedded router firmware). The attack is network-reachable (AV:N) and low-complexity (AC:L), and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms the injection yields full confidentiality, integrity, and availability impact on the device itself, with no confirmed scope change to downstream components. The only real gating factor is authentication: PR:H means the request must come from an authenticated administrative session on the management interface, which makes credential hygiene and management-plane exposure the decisive controls.
Know when Dir 605 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin feature with low-complexity injection, but PR:H because invoking the Firmware Update Service requires authenticated admin access; full device compromise gives C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
The D-Link DIR-605 router, an end-of-life device, contains a high-severity command injection vulnerability (CVE-2025-14884) that allows an attacker with administrative access to execute arbitrary commands. Organizations still using these routers are at risk because publicly available exploit code exists and no vendor-released patch identified at time of analysis. Leadership should prioritize identifying and replacing these devices to prevent potential network compromise.
Restrict management interface to trusted networks, enforce strong unique admin credentials, disable remote administration, segment devices on isolated VLANs, and monitor for anomalous command injection activity. Ultimate mitigation is replacement due to end-of-life status.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB