Executive brief
D-Link DAP-1360 is a wireless access point used to extend network coverage in homes and offices. The device's web management interface contains a critical flaw that allows attackers on the network to execute arbitrary commands with root privileges without needing any login credentials. An attacker can use this to take complete control of the device, modify its configuration permanently, and use it as a launching point to attack other devices on the network.
Technical details
The formSystemCheck handler in the web interface (POST /apply.cgi?formSystemCheck) constructs a shell command by directly concatenating the unsanitized ipv4_ping CGI parameter into a system() call via vsprintf, enabling OS command injection. The handler lacks authentication checks, allowing unauthenticated network-adjacent attackers to inject arbitrary shell commands executed as root. An attacker can achieve persistent compromise and lateral movement within the local network.
Affected products
- D-Link DAP-1360 6.14 and earlier
Timeline
- 2026-09-18: disclosed
- 2026-09-22: advisory