{"id":"CVE-2025-4349","state":"PUBLISHED","title":"D-Link DIR-600L formSysCmd command injection","description":"A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.","publishedAt":"2025-05-06T11:31:04.439Z","updatedAt":"2025-05-06T13:29:54.757Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["D-Link DIR-600L"],"affected":[{"vendor":"D-Link","product":"DIR-600L","versions":[{"version":"2.07B01","status":"affected"}]}],"references":["https://vuldb.com/?id.307467","https://vuldb.com/?ctiid.307467","https://vuldb.com/?submit.558302","https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Command_injection-formSysCmd-sysCmd/README.md","https://www.dlink.com/"],"weaknesses":["CWE-77","CWE-74"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4349.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4349","state":"PUBLISHED","datePublished":"2025-05-06T11:31:04.439Z","dateUpdated":"2025-05-06T13:29:54.757Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-05-05T16:58:51.336Z"},"containers":{"cna":{"title":"D-Link DIR-600L formSysCmd command injection","descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer."},{"lang":"de","value":"Es wurde eine Schwachstelle in D-Link DIR-600L bis 2.07B01 entdeckt. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion formSysCmd. Mittels Manipulieren des Arguments host mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren."}],"affected":[{"vendor":"D-Link","product":"DIR-600L","versions":[{"version":"2.07B01","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.307467","name":"VDB-307467 | D-Link DIR-600L formSysCmd command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.307467","name":"VDB-307467 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.558302","name":"Submit #558302 | D-Link DIR-600L 2.07B01 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Command_injection-formSysCmd-sysCmd/README.md","tags":["related"]},{"url":"https://www.dlink.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":9,"vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","type":"CWE","lang":"en","description":"Command Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-05-06T11:31:04.439Z"},"timeline":[{"time":"2025-05-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-05T19:04:13.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"B1Nn (VulDB User)","type":"reporter"}],"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-06T13:29:33.342542Z","id":"CVE-2025-4349","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-06T13:29:54.757Z"}}]}}}