D-Link 無線路由器 - OS Command Injection

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.twcert.org.tw/tw/cp-132-8090-bf06b-1.html
• https://www.akamai.com/blog/security/command-injection-on-a-d-link-router
• https://helpcenter.trendmicro.com/en-us/article/tmka-20701
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10413
• https://fieldeffect.com/blog/legacy-d-link-routers-exploited-via-unauthenticated-dns-hijacking
• https://www.secpod.com/blog/d-link-dsr-routers-critical-command-injection-vulnerabilities/
• https://www.exploit-db.com/exploits/44760
• https://cyber-maya.github.io/posts/Post-44/
• https://nvd.nist.gov/vuln/detail/cve-2021-45382
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488
• https://thehackernews.com/2026/01/active-exploitation-hits-legacy-d-link.html
• https://www.exploit-db.com/exploits/52508
• https://www.dlink.com/al/sq/support/support-news/2023/november/23/g416-lan-side-unathenticated-command-injection
• https://tp2rc.tanet.edu.tw/node/361

Related Vulnerabilities

• PoCCVE-2025-51683: mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE
• PoCCVE-2026-0702: VidShop for WooCommerce <= 1.1.4 - SQL Injection
• PoCCVE-2026-1281: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
• PoCCVE-2026-21875: ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection
• PoCCVE-2026-56292: AcyMailing < 10.11.1 - Unauthenticated SQL Injection
• PoCCVE-2026-59509: cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection
• PoCCVE-2026-9586: Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection
• 思考軟體科技｜電子柵欄 - SQL Injection
• 綠色運算｜NUMail - OS Command Injection
• PoCCVE-2026-65761: Joomla Easy Store - SQL Injection
• PoCCVE-2023-25826: OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection
• PoCCVE-2020-10221: rConfig <= 3.9.4 - Authenticated OS Command Injection
• PoCCVE-2026-76904: GeoServer jsonArrayContains CQL Filter - SQL Injection