CVE-2013-10050

This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the `tools_vct.xgi` endpoint. It supports two exploitation methods: direct command execution or spawning a telnet backdoor service.

This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via command injection in the `tools_vct.xgi` endpoint. It authenticates, triggers a telnet service on a random port, and establishes a reverse shell.

This exploit demonstrates a stored XSS vulnerability in D-Link DIR-635 firmware 2.34EU, where malicious JavaScript can be injected into the SSID parameter. It also includes details on reflected XSS, CSRF, and an authentication bypass for password changes.