Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-10050.
PoCs published by Metasploit, m-1-k-3, including Metasploit module exploits/linux/http/dlink_dir300_exec_telnet.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the `tools_vct.xgi` endpoint. It supports two exploitation methods: direct command execution or spawning a telnet backdoor service.
Description
An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is present in firmware versions that expose tools_vct.xgi and use the Mathopd/1.5p6 web server. No vendor patch is available, and affected models are end-of-life.
Exploits (3)
This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via the `tools_vct.xgi` endpoint. It supports two exploitation methods: direct command execution or spawning a telnet backdoor service.
This exploit demonstrates a stored XSS vulnerability in D-Link DIR-635 firmware 2.34EU, where malicious JavaScript can be injected into the SSID parameter. It also includes details on reflected XSS, CSRF, and an authentication bypass for password changes.
This Metasploit module exploits an unauthenticated remote command execution vulnerability in D-Link routers via command injection in the `tools_vct.xgi` endpoint. It authenticates, triggers a telnet service on a random port, and establishes a reverse shell.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H