D-Link R15 AX1500 Command Injection Vulnerability in httpd

A command injection vulnerability has been identified in the D-Link R15 AX1500 router, in firmware versions 1.20.01 and earlier. This vulnerability arises from inadequate validation of user input in the web administration interface. By manipulating the model name parameter during a password change request, it is possible to execute arbitrary system commands on the device.

Impact

Exploitation of this vulnerability allows an authenticated user to execute arbitrary commands on the router's operating system.

Remediation

Users are advised to update to the version R15A1_FW120B99_Beta. After updating, it is important to verify the success of the update by checking the device's software version against the version of the update.