CVE-2013-10048: An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01…

PriorityP184critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

12.10%

95.7th percentile

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-300	<= 2.13	—
d-link	dir-600	<= 2.14b01	—
dlink	dir-300_firmware	<= 2.13	—
dlink	dir-600_firmware	<= 2.14b01	—

Detection & IOCsextracted from sources · hover to see the quote

path/command.php↗

→Monitor for unauthenticated POST requests targeting /command.php on D-Link router web interfaces; the 'cmd' parameter carries the injected OS command payload. ↗
→Alert on POST requests to /command.php that contain shell metacharacters or command sequences (e.g., semicolons, pipes, backticks) in the cmd parameter, indicative of OS command injection attempts. ↗
→Watch for unexpected Telnet service activation on D-Link DIR-300/DIR-600 devices following web requests to /command.php, as attackers may use the injection to launch a Telnet backdoor. ↗
→Scope detection to D-Link DIR-600 firmware 2.14b01 and DIR-300 rev B firmware 2.13, as these are the confirmed vulnerable versions tested with the exploit module. ↗

·The vulnerable endpoint /command.php requires no authentication, meaning any network-reachable client can trigger the injection without credentials — standard auth-based controls will not mitigate this. ↗
·Exploitation results in root-level command execution, meaning post-exploitation activity (credential theft, config changes, service manipulation) will appear as legitimate root process activity on the device. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.