CVE-2013-10059

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-10059
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb Exploit
https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008 Third Party Advisory
https://www.exploit-db.com/exploits/24477 Exploit
https://www.exploit-db.com/exploits/25609 Exploit
https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection Third Party Advisory
https://www.exploit-db.com/exploits/24477 Exploit
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dir-615h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-615h:-:*:*:*:*:*:*:*
History

23 Sep 2025, 19:10

Type Values Removed Values Added
CPE cpe:2.3:o:dlink:dir-615h_firmware:8.04:*:*:*:*:*:*:* cpe:2.3:o:dlink:dir-615h_firmware:*:*:*:*:*:*:*:*

23 Sep 2025, 17:11

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CPE cpe:2.3:h:dlink:dir-615h:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-615h_firmware:8.04:*:*:*:*:*:*:*
First Time Dlink dir-615h
Dlink
Dlink dir-615h Firmware
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb - Exploit
References () https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008 - () https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008 - Third Party Advisory
References () https://www.exploit-db.com/exploits/24477 - () https://www.exploit-db.com/exploits/24477 - Exploit
References () https://www.exploit-db.com/exploits/25609 - () https://www.exploit-db.com/exploits/25609 - Exploit
References () https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection - () https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection - Third Party Advisory

04 Aug 2025, 15:15

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos del sistema operativo autenticado en varios routers D-Link (probados en DIR-615H1 con la versión de firmware 8.04) a través del endpoint tools_vct.htm. La interfaz web no depura la entrada enviada desde el parámetro ping_ipaddr a la interfaz de diagnóstico tools_vct.htm, lo que permite a los atacantes inyectar comandos de shell arbitrarios mediante encapsulación de comillas invertidas. Con credenciales predeterminadas, un atacante puede explotar este vector de inyección ciega para ejecutar comandos arbitrarios.
References () https://www.exploit-db.com/exploits/24477 - () https://www.exploit-db.com/exploits/24477 -

01 Aug 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-01 21:15

Updated : 2025-09-23 19:10

NVD link : CVE-2013-10059

Mitre link : CVE-2013-10059

CVE.ORG link : CVE-2013-10059

JSON object : View

Products Affected

dlink

  • dir-615h_firmware
  • dir-615h
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')