CVE-2013-10048

The command.php endpoint accepts HTTP POST requests without any authentication mechanism. The cmd parameter passed in the request body is not properly sanitized, which allows an attacker to inject arbitrary system commands. These commands are executed directly by the device's operating system with root privileges. It is sufficient to send a crafted POST request over the network, without the need to possess any login credentials.

The attacker gains full control of the device with root privileges, which enables launching services such as Telnet, stealing authentication credentials, modifying system configuration, and disrupting device availability.

Apply patches available from the manufacturer according to the references. Due to the legacy status of the devices, it is recommended to verify firmware update availability from the manufacturer, and in case of unavailability — isolate the devices from the public Internet and restrict access to the management interface exclusively to trusted hosts on the local network. Consider replacing the devices with current models supported by the manufacturer.

D-Link DIR-300 rev B and D-Link DIR-600 with firmware version ≤ 2.13 (DIR-300) and ≤ 2.14b01 (DIR-600)