CVE-2013-10069 - D-Link Devices Unauthenticated RCE

Back Back to CVE browser

CRITICAL

D-Link Devices Unauthenticated RCE

Published Aug 5, 2025

10.0

CRITICAL

CVSS 4.0

EPSS 16.72%

Description

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.

Affected products

Vendor D-Link Product DIR-300 rev B Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.13
Vendor D-Link Product DIR-600 rev B Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.14b01

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

D-Link

DIR-300 rev B

unaffected

Version	Status	Constraints
0	affected	<=2.13

D-Link

DIR-600 rev B

unaffected

Version	Status	Constraints
0	affected	<=2.14b01

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/dlink_dir_300_600_exec_noauth.rb
exploit
https://web.archive.org/web/20150428184723/http://www.s3cur1ty.de/m1adv2013-003
technical-descriptionexploitThird Party Advisory
https://www.exploit-db.com/exploits/24453
exploit
https://www.vulncheck.com/advisories/dlink-devices-unauth-rce
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/dlink_dir_300_600_exec_noauth.rb		exploit
https://web.archive.org/web/20150428184723/http://www.s3cur1ty.de/m1adv2013-003		technical-descriptionexploitThird Party Advisory
https://www.exploit-db.com/exploits/24453		exploit
https://www.vulncheck.com/advisories/dlink-devices-unauth-rce		third-party-advisoryThird Party Advisory