CVE-2017-9675

This issue is like someone being able to press the router’s reset button from across the network—without needing a password. That reset forces the router to reboot, which briefly cuts off your internet and internal network until it comes back up. For small businesses, that can mean short but real downtime for employees and customers.

This matters if you run a D-Link DIR-605L router and it’s using firmware earlier than 2.08UIBetaB01.bin. Because the request does not require login or user interaction, the risk is tied to whether the router is reachable from where an attacker can send network traffic.

In short: it’s a risk if the router is reachable over the network (especially when reachable from the internet or untrusted networks) and you’re on firmware before 2.08UIBetaB01.bin.

Attackers can trigger this with a single unauthenticated web request, and it’s reachable in a default configuration, so it can cause real availability disruption. There’s also public exploit availability, which increases practical risk.

Follow through promptly with the firmware update. This is not an “ignore until later” problem for business continuity, but it’s also not listed as a CISA KEV item in the provided findings—so handle it as a priority update rather than an emergency incident.