cbcvebase.
CVE-2020-9377
published 2020-07-09

CVE-2020-9377: D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer…

PriorityP184high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
21.34%
97.3th percentile
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Detection & IOCsextracted from sources · hover to see the quote

urlcommand.php↗
othercmd↗
  • →Monitor HTTP requests targeting 'command.php' on D-Link DIR-610 devices, specifically inspecting the 'cmd' parameter for shell command injection payloads. ↗
  • →Any inbound request to 'command.php' with a populated 'cmd' parameter should be treated as a high-confidence exploitation attempt against CVE-2020-9377. ↗
  • ·This vulnerability only affects D-Link DIR-610 devices, which are end-of-life and no longer supported by the maintainer. Detection efforts should be scoped accordingly. ↗
  • ·CISA flags this as a Known Exploited Vulnerability (KEV), indicating active in-the-wild exploitation. Any DIR-610 still in use should be treated as a critical risk asset. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.