cbcvebase.
CVE-2013-5946
published 2013-12-19

CVE-2013-5946: The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with…

PriorityP264critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
6.52%
93.8th percentile
The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "Ping or Trace an IP Address" or (2) "Perform a DNS Lookup" section.

Affected

64 ranges· showing 25
VendorProductVersion rangeFixed in
dlinkdsr-1000_firmware<= 1.08b51—
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000_firmware——
dlinkdsr-1000n_firmware<= 1.08b51—
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-1000n_firmware——
dlinkdsr-150_firmware<= 1.08b29—

Detection & IOCsextracted from sources · hover to see the quote

path/systemCheck.htm↗
commandtelnetd -l /bin/sh↗
commandkill <pid>↗
path/etc/passwd↗
path/etc/profile↗
  • →Monitor HTTP POST requests to /systemCheck.htm containing shell metacharacters in Ping/Trace or DNS Lookup parameters, indicating command injection attempts against CVE-2013-5946. ↗
  • →Detect spawning of 'telnetd -l /bin/sh' on D-Link DSR devices, which indicates successful exploitation and backdoor implantation. ↗
  • →Alert on Telnet connections to D-Link DSR routers immediately following HTTP requests to /systemCheck.htm, as the exploit chains command injection with telnet backdoor access. ↗
  • →Detect SQL injection authentication bypass attempts using the credential pattern "' or 'a'='a" in the router login form (CVE-2013-5945, chained with CVE-2013-5946). ↗
  • →Monitor for writes to /etc/passwd on D-Link DSR devices via shell commands, indicating persistent credential modification post-exploitation. ↗
  • ·The exploit targets multiple D-Link DSR firmware versions; the vulnerable endpoint /systemCheck.htm is only present on unpatched firmware. Verify firmware versions: DSR-150/250/250N before 1.08B44/1.05B64, DSR-500/500N/1000/1000N before 1.08B77. ↗
  • ·The backdoor changes introduced by this exploit (telnetd replacement, /etc/passwd modification) are non-persistent across reboots unless /tmp/teamf1.cfg.ascii is edited. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.