| 标题 | D-Link DIR-860L Rev.B 2.04.B04 Command Injection |
|---|
| 描述 | A critical unauthenticated command injection vulnerability was discovered in the firmware of the D-Link DIR-860L router. The vulnerability exists within the device's SSDP (Simple Service Discovery Protocol) service and allows a remote attacker to execute arbitrary system commands on a target device by sending a specially crafted M-SEARCH network packet.
The root cause of the vulnerability is that the application directly takes the value of the ST (Search Target) header from an SSDP request and concatenates it into a string that is passed to the system() function, without proper validation or sanitization. An attacker can exploit this flaw by injecting shell metacharacters (such as a semicolon) into the ST header to append and execute arbitrary commands, leading to remote code execution. |
|---|
| 来源 | ⚠️ https://github.com/i-Corner/cve/issues/17 |
|---|
| 用户 | iC0rner (UID 82839) |
|---|
| 提交 | 2025-08-06 20時29分 (1 年前) |
|---|
| 管理 | 2025-08-14 09時15分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 320091 [D-Link DIR-860L 2.04.B04 Simple Service Discovery Protocol htdocs/cgibin ssdpcgi_main 权限提升] |
|---|
| 积分 | 20 |
|---|