Critical · published August 5, 2025
🚨 An unauthenticated command injection in D-Link routers means attackers can take root access without lifting a finger! 🔥 Think of it like a pizza delivery person with a spare key to your home – they can walk right in and set up a pizza party without you even knowing! If exploited, a remote attacker could spin up a Telnet service on a specified port, granting them full control over your router. This means they could monitor your traffic, change settings, or even hijack your entire network without you having any clue. Yikes!
Think of it like a pizza delivery person with a spare key to your home – they can walk right in and set up a pizza party without you even knowing! This vulnerability allows an unauthenticated attacker to execute arbitrary OS commands through a flaw in the handling of the 'cmd' POST parameter in the command.php file of multiple D-Link routers. The affected versions include DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13).
If exploited, a remote attacker could spin up a Telnet service on a specified port, granting them full control over your router. This means they could monitor your traffic, change settings, or even hijack your entire network without you having any clue. Yikes! Immediate action is required! Update your D-Link router firmware to the latest version to patch this vulnerability. If you can’t update right away, disable remote management features and ensure your network is secure while you work on the fix. You've got this! With a quick firmware update, you can kick this vulnerability to the curb and secure your network! 🛡️