D-Link DIR-605L Command Injection Vulnerability in Wake-on-LAN Function

A critical command injection vulnerability has been identified in the D-Link DIR-605L router, specifically in version 2.13B01. The issue arises in the wake-on-lan function, where improper handling of the MAC address argument allows for remote command injection. This vulnerability affects devices that are no longer supported by the vendor.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the affected device.

Reproduction

To reproduce this vulnerability, send a request to the DIR-605L router's wake-on-lan function with a crafted MAC address that exploits the command injection flaw. This can be done remotely, targeting the specific version 2.13B01.