Loading
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.
Use CWE-78, Dlink vendor hub and Dir-600 Firmware product page to widen CVE-2013-10069 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2014-100005, CVE-2018-25115 and CVE-2023-33626 for nearby disclosures in the same product family.