CVE-2013-10050

This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the `tools_vct.xgi` endpoint. It supports two exploitation methods: direct command execution or spawning a telnet backdoor service.

This exploit demonstrates a stored XSS vulnerability in D-Link DIR-635 firmware 2.34EU, where malicious JavaScript can be injected into the SSID parameter. It also includes details on reflected XSS, CSRF, and an authentication bypass for password changes.

This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via command injection in the `tools_vct.xgi` endpoint. It authenticates, triggers a telnet service on a random port, and establishes a reverse shell.