D-Link Devices command.php Unauthenticated RCE
68Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 9.3epss 12%
da publicação à arma0 dias
Publicada no NVD1 de ago.
metasploit4 de fev.
probabilidade de exploração
12%top 4% das CVEs
exploração observada
nãonenhuma fonte reporta
4 exploit(s) público(s)
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
PoCs públicas encontradas — 4
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_command_php_exec_noauth.rbnão verificadocve_referenceweb.archive.org/web/20131022221648/http://www.s3cur1ty.de/m1adv2013-003não verificadocve_referencewww.exploit-db.com/exploits/24453não verificadocve_referencewww.exploit-db.com/exploits/27528não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_command_php_exec_noauth.rbhttps://web.archive.org/web/20131022221648/http://www.s3cur1ty.de/m1adv2013-003https://www.exploit-db.com/exploits/24453https://www.exploit-db.com/exploits/27528https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce