CVE-2013-10069 — D-Link Devices Unauthenticated RCE
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in com…
Published: 2025-08-05 · CVSS: 10.0 · CVSS 4.0
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7