D-Link DI-7001 MINI Command Injection Vulnerability Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in the D-Link DI-7001 MINI gateway, specifically in the firmware versions 19.09.19A1 and 24.04.18B1. The vulnerability arises from an unknown function in the file '/msp_info.htm', where the 'cmd' argument can be manipulated to inject commands. This issue can be exploited remotely, leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a GET request to '/msp_info.htm' with the 'flag' parameter set to 'cmd' and the 'cmd' parameter containing the injected command. The injection can bypass existing command filters and execute commands on the device's operating system.