D-Link DIR816 Firmware Command Injection via DMZIPAddress

D-Link DIR 816 Firmware Command Injection Vulnerability Summary Vulnerability Overview In the D-Link DIR 816 firmware, the handler receives a user-controlled parameter. When is set to IP mode, this value is only validated by , which relies on . No filtering of shell metacharacters or secure command escaping is performed. After passing this check, the raw string is stored directly into the variable in nvram. Subsequently, within , retrieves the saved value and inserts it into a command string using . The resulting command buffer is passed to . Consequently, when the stored web parameter reaches the shell execution stage, an authenticated attacker can modify the DMZ configuration and trigger a firewall refresh path (e.g., via ), thereby injecting the stored value into command execution on the device. Vulnerability Chain: -> Weak validation in -> -> -> -> Affected Scope Affected Devices: D-Link DIR 816 firmware Affected File: Vulnerability Type: Command Injection Vulnerable String: Remediation Perform strict input validation and filtering on the parameter to ensure it does not contain shell metacharacters or command injection characters. Use secure APIs or functions to handle user input, avoiding the use of unsafe functions like . Escape or sanitize command strings before executing system commands. POC Code ```c int __fastcall sub_44C54C(int a1) { int result; // $s0 int v2; // $v0 int v4; // $s2 int v5; // $s0 int v6; // $fp int v7; // $s1 int v8; // $s3 int v9; // $s0 int v10; // $v0 _BYTE v11[16]; // [sp+10h] [-10h] BYREF result = nvram_bufget(0, "SinglePortForwardRules"); v3 = result; if ( result ) { result = (char )result; if ( result ) { result = sub_4407CC(v3, 50); v4 = result; if ( result ) { result = malloc(4 result); v5 = (int )result; if ( result ) { v6 = strdup(v3); if ( v6 ) { v7 = 0; v8 = 0; if ( v4 /var/udpbackup"); doSystem("echo 0 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout; rm -f /var/udpbackup"); doSystem("cat /var/udpbackup > /proc/sys/net/netfilter/nf_conntrack_udp_timeout; rm -f /var/udpbackup"); doSystem("cat /var/tcpbackup > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established > /var/tcpbackup"); doSystem("echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established"); doSystem("cat /var/tcpbackup > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established; rm -f /var/tcpbackup"); websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader((int)a1, websHeader(

Goal Reached Thanks to every supporter — we hit 100%!

D-Link DIR816 Firmware Command Injection via DMZIPAddress

More from this source