D-Link DIR-823X Command Injection Vulnerability in Traceroute Diagnostic Function

A command injection vulnerability has been identified in the D-Link DIR-823X router, specifically in the 250416 firmware version. The issue arises in the '/goform/diag_traceroute' file, where the 'target_addr' parameter is not properly validated. This lack of validation allows attackers to inject malicious strings, potentially leading to the execution of arbitrary commands on the device. The vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router.

Reproduction

To reproduce this vulnerability, log into the D-Link DIR-823X router and navigate to the traceroute diagnostic function. The 'target_addr' parameter can be manipulated by injecting a command, such as '127.0.0.1;ls', which exploits the command injection flaw by executing the 'ls' command on the router's operating system.