PT-2025-31693 · D Link · Dlink Router

Published 2012-11-11 · Updated 2025-09-23 · CVE-2013-10059

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link routers version 8.04

Description An authenticated OS command injection vulnerability exists via the tools vct.htm endpoint. The web interface fails to sanitize input passed from the ping ipaddr parameter to the tools vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.

Recommendations For version 8.04, ensure proper input sanitization is implemented for the ping ipaddr parameter within the tools vct.htm endpoint to prevent command injection. As a temporary workaround, restrict access to the tools vct.htm interface.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-09492

CVE-2013-10059

Affected Products

Dlink Router

References · 9

• 🔥 https://exploit-db.com/exploits/25609 · Exploit
• 🔥 https://exploit-db.com/exploits/24477 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-10059 · Security Note
• https://bdu.fstec.ru/vul/2025-09492 · Security Note
• https://vulncheck.com/advisories/d-link-legacy-os-command-injection · Note
• https://t.me/CVEtracker/28980 · Telegram Post
• https://web.archive.org/web/20150921102603/http://s3cur1ty.de/m1adv2013-008 · Note
• https://t.me/cveNotify/136186 · Telegram Post