CVE-2013-10059

An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb	Exploit
https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008	Third Party Advisory
https://www.exploit-db.com/exploits/24477	Exploit
https://www.exploit-db.com/exploits/25609	Exploit
https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection	Third Party Advisory
https://www.exploit-db.com/exploits/24477	Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dlink:dir-615h_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-615h:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-01 21:15

Updated : 2025-09-23 19:10

NVD link : CVE-2013-10059

Mitre link : CVE-2013-10059

CVE.ORG link : CVE-2013-10059

JSON object : View

Products Affected

dlink

dir-615h_firmware
dir-615h

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2013-10059", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "[email protected]"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-01T21:15:28.000", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/24477", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/25609", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/24477", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1\u00a0running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo autenticado en varios routers D-Link (probados en DIR-615H1 con la versi\u00f3n de firmware 8.04) a trav\u00e9s del endpoint tools_vct.htm. La interfaz web no depura la entrada enviada desde el par\u00e1metro ping_ipaddr a la interfaz de diagn\u00f3stico tools_vct.htm, lo que permite a los atacantes inyectar comandos de shell arbitrarios mediante encapsulaci\u00f3n de comillas invertidas. Con credenciales predeterminadas, un atacante puede explotar este vector de inyecci\u00f3n ciega para ejecutar comandos arbitrarios."}], "lastModified": "2025-09-23T19:10:54.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-615h_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAD1E083-0E9D-482F-86FA-D1460E7A66D9", "versionEndIncluding": "8.04"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-615h:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8755FFC3-D036-47E0-B868-3037EACDE4A2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}