CVE-2013-10048

Katalog CVE

CVSS 9.8 · Critical EPSS 17,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada dlink dir-300 firmware, dlink dir-600 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.

Rincian

Terbit di NVD

1 Agustus 2025

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

17,1% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://web.archive.org/web/20131022221648/http://www.s3cur1ty.de/m1adv2013-003 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce advisory pihak ketiga
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_command... exploit
• https://www.exploit-db.com/exploits/24453 exploit
• https://www.exploit-db.com/exploits/27528 exploit