CVE-2013-10048
📋 TL;DR
This CVE describes an unauthenticated remote command execution vulnerability in legacy D-Link routers. Attackers can send specially crafted POST requests to the command.php endpoint to execute arbitrary shell commands with root privileges. This affects D-Link DIR-300 rev B and DIR-600 routers with vulnerable firmware versions.
💻 Affected Systems
- D-Link DIR-300 rev B
- D-Link DIR-600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing credential theft, persistent backdoor installation, network traffic interception, and device bricking.
Likely Case
Router compromise leading to credential harvesting, network reconnaissance, and potential lateral movement to connected devices.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Multiple public exploits exist including Metasploit modules. Exploitation requires only HTTP POST requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available. Consider replacing affected legacy hardware with supported models.
🔧 Temporary Workarounds
Block command.php endpoint
linuxUse router firewall rules or web server configuration to block access to /command.php
iptables -A INPUT -p tcp --dport 80 -m string --string "command.php" --algo bm -j DROP
Disable web management interface
allTurn off web-based administration if not required
🧯 If You Can't Patch
- Segment affected routers in isolated network zones with strict firewall rules
- Implement network monitoring for suspicious POST requests to command.php
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or using nmap scan for device identification.Check Version:
curl -s http://192.168.0.1/ | grep -i firmwareVerify Fix Applied:
Test if command.php endpoint returns 404 or is inaccessible. Attempt exploitation with safe test payload.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /command.php
- Unusual process execution in router logs
- Telnet service activation logs
Network Indicators:
- POST requests with shell metacharacters in parameters
- Unexpected outbound connections from router
- Telnet traffic from router
SIEM Query:
source="router_logs" AND (url="/command.php" OR cmd="*;*" OR cmd="*|*")🔗 References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb
- https://web.archive.org/web/20131022221648/http://www.s3cur1ty.de/m1adv2013-003
- https://www.exploit-db.com/exploits/24453
- https://www.exploit-db.com/exploits/27528
- https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce
- https://www.exploit-db.com/exploits/27528
