Home

Description

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within the SetDest/Dest/Target arguments to the GetDeviceSettings form. The management interface is accessible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet.

PUBLISHED Reserved 2025-11-05 | Published 2025-11-06 | Updated 2025-11-07 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

Any version
affected

Timeline

2022-05-11:Exodus Intelligence publicly discloses technical details of vulnerability.
2022-05-05:D-Link releases patched version - v1.02B06_Beta Hotfix.

Credits

Exodus Intelligence finder

References

supportannouncement.us.dlink.com/...ation.aspx?name=SAP10298 vendor-advisory patch

blog.exodusintel.com/...uth-command-injection-vulnerability/ technical-description

www.vulncheck.com/...tings-unauthenticated-command-injection third-party-advisory

cve.org (CVE-2022-50596)

nvd.nist.gov (CVE-2022-50596)

Download JSON