CVE-2013-10069

The vulnerability results from improper handling of a POST parameter named 'cmd' in the command.php file — user input is passed directly to a system call without proper validation or sanitization (CWE-78). An attacker can craft an appropriate HTTP request and inject arbitrary operating system commands. The described example of exploitation is running the Telnet service on a specified port, which provides persistent, interactive access to the system shell with root privileges.

The attacker gains full, persistent access to the operating system shell with root privileges without needing any credentials, enabling complete device takeover, modification of its configuration, and further lateral movement in the network.

Patches available from the manufacturer should be applied according to references. Due to the age of the devices and lack of active manufacturer support, replacement with a newer model covered by support is recommended. As an interim workaround, access to the router's web interface from external networks should be blocked and local access should be restricted only to trusted hosts using a firewall.

D-Link DIR-600 rev B with firmware version ≤2.14b01 and D-Link DIR-300 rev B with firmware version ≤2.13