D-Link DIR-645 Command Injection Vulnerability

A command injection vulnerability has been identified in the D-Link DIR-645 router, specifically in the 105B01 firmware version. The issue arises in the 'soapcgi_main' function of the '/soap.cgi' file, where improper handling of the 'service' argument allows for arbitrary command execution. This vulnerability can be exploited remotely and affects devices that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a request to the '/soap.cgi' endpoint with a crafted 'service' parameter that exploits the command injection flaw. The injected command will be executed on the router's operating system.