Executive brief
Multiple D-Link routers are vulnerable to a command injection flaw that allows an authenticated user to take full control of the device. By sending a specially crafted request to the router's diagnostic tools, an attacker can execute system-level commands, potentially leading to data interception or the establishment of a persistent backdoor. These devices are end-of-life, meaning no official security patches will be released.
Technical details
An OS command injection vulnerability exists in the authenticated `tools_vct.xgi` CGI endpoint of several D-Link routers, specifically confirmed on DIR-300 rev A (v1.05) and DIR-615 rev D (v4.13). The vulnerability is caused by insufficient sanitization of the `pingIp` parameter within the `set/runtime/diagnostic/` path. An attacker with valid web interface credentials can use shell metacharacters (e.g., backticks) to inject and execute arbitrary commands with root privileges. This can be leveraged to spawn a telnet daemon on a random port for persistent remote access. The affected devices utilize the Mathopd/1.5p6 web server. No patches are available as the models are end-of-life.
Affected products
- D-Link DIR-300 rev A 1.05
- D-Link DIR-615 rev D 4.13
Timeline
- 2012-10-15: other: Vulnerability discovered and vendor contacted
- 2013-04-22: disclosed: Public disclosure date
- 2013-04-22: patched: Vendor released firmware updates 1.06 (DIR-300) and 4.14b02 (DIR-615) to address some issues, though reports indicate some vulnerabilities remained unfixed.
- 2025-08-01: advisory: CVE-2013-10050 published to NVD
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir300_exec_telnet.rb
- https://web.archive.org/web/20140830203110/http://www.s3cur1ty.de/m1adv2013-014
- https://www.exploit-db.com/exploits/25024
- https://www.exploit-db.com/exploits/27428
- https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce-2
- https://www.exploit-db.com/raw/25024