CVE-2020-9377
Published on July 9, 2020

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This D-Link DIR-610 Devices Remote Command Execution vulnerability is part of CISA's list of Known Exploited Vulnerabilities. D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.

The following remediation steps are recommended / required by April 15, 2022: The impacted product is end-of-life and should be disconnected if still in use.

Vulnerability Analysis

CVE-2020-9377 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2020-9377 has been classified to as a Shell injection vulnerability or weakness.

Products Associated with CVE-2020-9377

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-9377 are published in these products:

What versions are vulnerable to CVE-2020-9377?