D-Link DI-7400G+ Command Injection Vulnerability

A command injection vulnerability has been identified in the D-Link DI-7400G+ router, specifically in version 19.12.25A1. The issue arises in an unknown function of the file '/msp_info.htm?flag=cmd', where the 'cmd' argument can be manipulated to execute arbitrary commands. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a malicious HTTP GET request to the '/msp_info.htm?flag=cmd' endpoint, including a crafted 'cmd' argument that exploits the command injection flaw.