CVE-2026-2163
📋 TL;DR
This CVE describes a command injection vulnerability in D-Link DIR-600 routers affecting the ssdp.cgi component. Attackers can remotely execute arbitrary commands by manipulating HTTP_ST, REMOTE_ADDR, REMOTE_PORT, or SERVER_ID parameters. Only unsupported legacy devices are affected.
💻 Affected Systems
- D-Link DIR-600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, or use device for botnet participation.
Likely Case
Remote code execution leading to device takeover, credential harvesting, or denial of service.
If Mitigated
Limited impact if device is isolated behind firewalls with strict network segmentation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires network access to device web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Network Isolation
linuxPlace affected routers behind firewalls with strict inbound rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface
allTurn off web administration interface if not required
🧯 If You Can't Patch
- Immediately replace affected devices with supported hardware
- Implement strict network segmentation and firewall rules to isolate vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://[router-ip]/status.asp or via SSH if enabledCheck Version:
curl -s http://[router-ip]/status.asp | grep 'Firmware Version'Verify Fix Applied:
Verify device replacement or test web interface access is blocked📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /ssdp.cgi with shell metacharacters
- Multiple failed authentication attempts followed by successful ssdp.cgi access
Network Indicators:
- HTTP requests to router IP with suspicious parameters like ;, |, &, or $( in URL
- Outbound connections from router to unexpected external IPs
SIEM Query:
source="router.log" AND (uri_path="/ssdp.cgi" AND (uri_query="*;*" OR uri_query="*|*" OR uri_query="*$(*"))🔗 References
- https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md
- https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc
- https://vuldb.com/?ctiid.344865
- https://vuldb.com/?id.344865
- https://vuldb.com/?submit.751764
- https://www.dlink.com/
