Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
D-Link Devices command.php Unauthenticated RCE
Vulnerability Description
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.
CVSS Information
N/A
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
D-Link DIR-600和D-Link DIR-300 rev B 安全漏洞
Vulnerability Description
D-Link DIR-600和D-Link DIR-300 rev B都是中国友讯（D-Link）公司的一款无线路由器。 D-Link DIR-300 rev B和D-Link DIR-600 2.13及之前版本和2.14b01及之前版本存在安全漏洞，该漏洞源于command.php端点输入处理不当，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A