D-Link DIR-823X Command Injection Vulnerability in set_static_leases Function

A command injection vulnerability has been identified in the D-Link DIR-823X router, affecting versions through 250416. The issue arises in the '/goform/set_static_leases' function, where manipulation of the 'hostname' argument can lead to unauthorized command execution. This vulnerability can be exploited remotely without authentication, allowing attackers to execute arbitrary commands and potentially gain shell access on the device.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected router, with the potential for privilege escalation.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/set_static_leases' endpoint. Include a crafted 'hostname' parameter that exploits the command injection flaw, along with the 'modmun', 'ipaddr', and 'macaddr' parameters. The request can be made using a script or tool that supports HTTP requests, such as Python with the 'requests' library.