CVE-2025-4349 D-Link DIR-600L formSysCmd command injection

What is CVE-2025-4349?

CVE-2025-4349 is a high-severity command injection vulnerability in D-Link DIR-600L, published on 6 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-77, CWE-74

Which versions are affected by CVE-2025-4349?

It affects 1 product.

Products include Dlink Dir-600l Firmware.

How do I fix CVE-2025-4349?

No fix has been published for CVE-2025-4349 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-4349 being exploited?

There is no known exploitation of CVE-2025-4349 in the wild and no public exploit code.

Other vulnerabilities in D-Link DIR-600L

• CVE-2026-42374 D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials Critical 9.8
• CVE-2026-42375 D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials Critical 9.8
• CVE-2025-60548 Memory corruption in n/a Critical 9.8
• CVE-2025-60553 Memory corruption in n/a Critical 9.8
• CVE-2025-60554 Memory corruption in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xvf2-2w45-wg4p.