High · published December 14, 2025
🚨 Command injection alert! A simple tweak to the Hostname argument in the DHCP Daemon of D-Link DIR-860LB1 and DIR-868LB1 can lead to remote exploits. ⚡ Think of it like a restaurant where a customer changes their order mid-meal, and the kitchen unwittingly prepares something entirely different without verifying the request — a recipe for disaster! If an attacker successfully exploits this vulnerability, they could execute arbitrary commands on the router, potentially compromising the entire network. The consequences are serious: unauthorized access, data breaches, and complete control over your network. It’s absolutely devastating!
Think of it like a restaurant where a customer changes their order mid-meal, and the kitchen unwittingly prepares something entirely different without verifying the request — a recipe for disaster! This vulnerability lies in the DHCP Daemon, where manipulation of the Hostname argument allows for command injection, enabling an attacker to run commands remotely on the affected devices.
If an attacker successfully exploits this vulnerability, they could execute arbitrary commands on the router, potentially compromising the entire network. The consequences are serious: unauthorized access, data breaches, and complete control over your network. It’s absolutely devastating! To safeguard your network, update your D-Link devices to the latest firmware version immediately. Regularly check for updates and ensure that your router’s settings are secured to minimize exposure. Don't wait for trouble to knock at your door! This is fixable! Follow these steps, and you'll be a security hero in no time! 🦸
| Product | Versions | Fixed in |
|---|---|---|
| dlink/dir-868l_b1_firmware | ≤ 203b01 | — |
| dlink/dir-860l_b1_firmware | ≤ 203b03 | — |