| शीर्षक | D-Link DIR-825M v1.1.8 Command Injection |
|---|
| विवरण | During a security review of the router's firmware, a critical command injection vulnerability was discovered in the /boafrm/formSysCmd endpoint.The vulnerability is located within the sub_456CF4 function. This function is designed to handle custom system command execution or diagnostics. It extracts the sysCmd parameter from the HTTP POST request. Due to the complete absence of input sanitization, filtering, or validation, a malicious actor can exploit this behavior by injecting Shell control operators (such as ;, &, or |) into the parameter. The input is formatted directly into a command string and passed to system(), leading to arbitrary command execution with root privilege. |
|---|
| स्रोत | ⚠️ https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formSysCmd/formSysCmd.md |
|---|
| उपयोगकर्ता | hacker128 (UID 93883) |
|---|
| सबमिशन | 16/07/2026 04:21 AM (2 महीनों पहले) |
|---|
| संयम | 30/08/2026 08:23 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397090 [D-Link DIR-825M 1.1.8 System Command Execution /boafrm/formSysCmd sub_456CF4 sysCmd अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|