CVE-2013-10048
CRITICALD-Link DIR-300 rev B & DIR-600 <2.13/2.14b01 - Command Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-10048.
PoCs published by Metasploit, m-1-k-3, including Metasploit module exploits/linux/http/dlink_command_php_exec_noauth.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the command.php endpoint. It supports two targets: direct command execution and spawning a telnet backdoor service.
Description
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.
Exploits (3)
This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the command.php endpoint. It supports two targets: direct command execution and spawning a telnet backdoor service.
This is a detailed vulnerability writeup for an unauthenticated OS command injection vulnerability in D-Link DIR-600 and DIR-300 routers. The vulnerability allows arbitrary command execution via the 'cmd' parameter in /command.php, enabling attackers to start a telnet server or extract credentials.
This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the command.php endpoint. It spawns a telnet service on a random port and establishes a session for command execution.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H