CVE-2013-10059

An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb
https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008
https://www.exploit-db.com/exploits/24477
https://www.exploit-db.com/exploits/25609
https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection
https://www.exploit-db.com/exploits/24477

Configurations

No configuration.

History

04 Aug 2025, 15:15

Type	Values Removed	Values Added
References	~~() https://www.exploit-db.com/exploits/24477 -~~	() https://www.exploit-db.com/exploits/24477 -
Summary		(es) Existe una vulnerabilidad de inyección de comandos del sistema operativo autenticado en varios routers D-Link (probados en DIR-615H1 con la versión de firmware 8.04) a través del endpoint tools_vct.htm. La interfaz web no depura la entrada enviada desde el parámetro ping_ipaddr a la interfaz de diagnóstico tools_vct.htm, lo que permite a los atacantes inyectar comandos de shell arbitrarios mediante encapsulación de comillas invertidas. Con credenciales predeterminadas, un atacante puede explotar este vector de inyección ciega para ejecutar comandos arbitrarios.

01 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-01 21:15

Updated : 2025-08-04 15:15

NVD link : CVE-2013-10059

Mitre link : CVE-2013-10059

CVE.ORG link : CVE-2013-10059

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2013-10059", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-01T21:15:28.000", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/24477", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/25609", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/24477", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1\u00a0running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo autenticado en varios routers D-Link (probados en DIR-615H1 con la versi\u00f3n de firmware 8.04) a trav\u00e9s del endpoint tools_vct.htm. La interfaz web no depura la entrada enviada desde el par\u00e1metro ping_ipaddr a la interfaz de diagn\u00f3stico tools_vct.htm, lo que permite a los atacantes inyectar comandos de shell arbitrarios mediante encapsulaci\u00f3n de comillas invertidas. Con credenciales predeterminadas, un atacante puede explotar este vector de inyecci\u00f3n ciega para ejecutar comandos arbitrarios."}], "lastModified": "2025-08-04T15:15:30.600", "sourceIdentifier": "disclosure@vulncheck.com"}