CVE-2025-4445
📋 TL;DR
This critical vulnerability in D-Link DIR-605L routers allows remote attackers to execute arbitrary commands via command injection in the wake_on_lan function's mac parameter. Only users of the DIR-605L router with firmware version 2.13B01 are affected, and this product is no longer supported by the vendor.
💻 Affected Systems
- D-Link DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to establish persistent access, intercept network traffic, pivot to internal systems, or use the device for botnet activities.
Likely Case
Remote code execution leading to router configuration changes, DNS hijacking, credential theft, or denial of service.
If Mitigated
Limited impact if the router is behind a firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit details available in GitHub repository. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
No official patch available. The product is end-of-life and no longer supported by D-Link.
🔧 Temporary Workarounds
Disable WAN access to management interface
linuxBlock external access to router administration interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable wake_on_lan functionality
linuxTurn off the vulnerable feature if not required
echo '0' > /proc/sys/net/ipv4/wol_enabled
🧯 If You Can't Patch
- Replace the vulnerable router with a supported model
- Isolate the router in a dedicated network segment with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://router_ip/ or using command: cat /proc/versionCheck Version:
cat /proc/version | grep '2.13B01'Verify Fix Applied:
No official fix available. Verify workarounds by testing external access to router management interface.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wake_on_lan endpoint
- Suspicious command execution in system logs
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unusual outbound connections from router
- DNS queries to malicious domains
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (uri="/wake_on_lan" OR command="wake_on_lan") AND (mac="*;*" OR mac="*|*" OR mac="*`*")