CVE-2013-10048

Description

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.

Reserved 2025-08-01 | Published 2025-08-01 | Updated 2025-08-01 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unknown

*
affected

Default status
unknown

*
affected

Credits

Michael Messner finder

References

raw.githubusercontent.com/...link_command_php_exec_noauth.rb exploit

www.exploit-db.com/exploits/24453 exploit

www.exploit-db.com/exploits/27528 exploit

web.archive.org/...1648/http://www.s3cur1ty.de/m1adv2013-003 technical-description exploit

www.vulncheck.com/advisories/d-link-legacy-unauth-rce third-party-advisory

cve.org (CVE-2013-10048)

nvd.nist.gov (CVE-2013-10048)

Download JSON