CVE-2025-4350
📋 TL;DR
A critical command injection vulnerability in D-Link DIR-600L routers allows remote attackers to execute arbitrary commands by manipulating the wake_on_lan function's host argument. This affects all DIR-600L routers up to firmware version 2.07B01. The vulnerability is particularly dangerous because these products are no longer supported by the vendor.
💻 Affected Systems
- D-Link DIR-600L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing persistent remote access, network traffic interception, lateral movement to connected devices, and potential ransomware deployment.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of malware on connected devices.
If Mitigated
Limited impact if router is isolated behind firewalls with strict inbound rules, though internal network compromise remains possible.
🎯 Exploit Status
Proof of concept code is publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
No official patch exists as D-Link has ended support for DIR-600L. The only secure solution is to replace the hardware with a supported model.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent remote access to the router's management interface from the internet
Login to router admin panel → Advanced → Remote Management → Disable
Disable Wake on LAN Function
allTurn off the vulnerable wake_on_lan functionality if not needed
Login to router admin panel → Tools → Wake on LAN → Disable
🧯 If You Can't Patch
- Immediately replace DIR-600L routers with supported hardware from any vendor
- Isolate vulnerable routers in a separate VLAN with strict firewall rules preventing all inbound traffic
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin panel under Status → Device Info. If version is 2.07B01 or earlier, the device is vulnerable.Check Version:
curl -s http://router-ip/status.cgi | grep firmware_versionVerify Fix Applied:
Since no patch exists, verification requires confirming router replacement or complete isolation from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wake_on_lan.cgi with shell metacharacters in parameters
- Unexpected command execution in router logs
- Failed authentication attempts followed by successful exploitation
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- DNS queries to suspicious domains from router itself
- Unexpected open ports on router
SIEM Query:
source="router_logs" AND (uri_path="/wake_on_lan.cgi" AND (param="host" CONTAINS "|" OR param="host" CONTAINS ";" OR param="host" CONTAINS "`"))