CVE-2013-10069: D-Link Devices Unauthenticated RCE
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-10069?
CVE-2013-10069 is considered a high severity vulnerability due to its potential for unauthenticated OS command injection.
How do I fix CVE-2013-10069?
To fix CVE-2013-10069, update the affected D-Link router models to the latest firmware versions provided by D-Link.
What devices are affected by CVE-2013-10069?
CVE-2013-10069 affects D-Link DIR-600 rev B models with firmware versions up to 2.14b01 and DIR-300 rev B up to 2.13.
Can CVE-2013-10069 be exploited remotely?
Yes, CVE-2013-10069 allows remote attackers to exploit the vulnerability without needing authentication.
What type of attack can CVE-2013-10069 facilitate?
CVE-2013-10069 facilitates OS command injection attacks that could compromise the router's functionality and security.