CVE-2025-14884

HighCVSS 7.2

Published: 18/12/2025(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.96%

96th percentile - higher than 96% of all known CVEs

Summary

A vulnerability was detected in D-Link DIR-605 202WWB03 in an unknown function of the Firmware Update Service component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is now public and may be used; this vulnerability only affects products no longer supported by the maintainer.

Risk Assessment

A remote attacker can execute arbitrary commands in the firmware update service, leading to full compromise of a device that no longer receives patches.

Recommendation

Since the product is no longer supported, replace the D-Link DIR-605 with a newer supported model and isolate it from the network if it is still in use.

Other vulnerabilities in D-Link DIR-605

CVE-2026-86297High
A vulnerability was identified in D-Link DIR-605 B1v202WWB03 in the tunnel_set_params function of the file progs.gpl/pppd.alpha/l2tp/tunnel.c in the L2TP Control Message Parser component. Manipulation of the argument peer_hostname leads to an off-by-one error. The attack may be performed remotely but is highly complex and difficult to exploit. The exploit is publicly available.

Original NVD description (English source)

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS