CVE-2013-10069

published 2025-08-05

CVE-2013-10069: The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection…

critical 10 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-300_rev_b	<= 2.13	—
d-link	dir-600_rev_b	<= 2.14b01	—
dlink	dir-300_firmware	<= 2.13	—
dlink	dir-600_firmware	<= 2.14b01	—

CWE-78