CVE-2020-9377 - D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php

Back Back to CVE browser

HIGH KEV

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php

Published Jul 9, 2020 ·Due Apr 15, 2022

8.8

HIGH

CVSS 3.1

EPSS 21.34%

Description

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://gist.github.com/GouveaHeitor/131557f9de7d571f118f59805df852dc
x_refsource_MISCBroken LinkExploitPatchThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182
x_refsource_CONFIRMExploitVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9377
government-resourceUS Government Resource
https://www.dlink.com.br/produto/dir-610/
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://gist.github.com/GouveaHeitor/131557f9de7d571f118f59805df852dc		x_refsource_MISCBroken LinkExploitPatchThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182		x_refsource_CONFIRMExploitVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9377		government-resourceUS Government Resource
https://www.dlink.com.br/produto/dir-610/		x_refsource_MISCProductVendor Advisory