Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14884: D-Link DIR-605: Firmware Update Service Remote Command Injection

CVE-2025-14884 · published 10 months ago

Summary

Some older D-Link DIR-605 models have a security weakness in their Firmware Update Service that can be exploited remotely. This means a hacker could potentially access and control the device. Since the manufacturer no longer supports these devices, there's no official fix available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dlink	dir-605_firmware	2.02ww `cpe:2.3:o:dlink:dir-605_firmware:2.02ww:::::::*`

Original advisory text

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

References

https://tzh00203.notion.site/D-Link-DIR605-B1v202WWB03-Command-Injection-in-Firm... Exploit Third Party Advisory
https://vuldb.com/?ctiid.337372 Permissions Required VDB Entry
https://vuldb.com/?id.337372 Third Party Advisory VDB Entry
https://vuldb.com/?submit.715465 Third Party Advisory VDB Entry
https://www.dlink.com/ Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.3 High

Exploitation

11% chance of attack within 30 days

Type

CWE-74Injection

CWE-77Command Injection

Timeline

Published18 Dec 2025

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-14884 · NVD

Track software like this

Free during beta