D-Link DIR-600L Command Injection Vulnerability in Wake-on-LAN Function

A critical command injection vulnerability has been identified in the D-Link DIR-600L router, affecting versions prior to 2.07B01. This vulnerability arises in the wake-on-lan function, where improper handling of the host argument allows for remote command injection. The issue is present in products that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a request to the DIR-600L router's wake-on-lan function with a crafted host argument that includes malicious payloads. The router must be running a vulnerable firmware version and not be under active support from D-Link.