D-Link DI-7300G+ OS Command Injection Vulnerability

A critical command injection vulnerability has been identified in the D-Link DI-7300G+ router, specifically in version 19.12.25A1. The issue arises in the file httpd_debug.asp, where the Time parameter can be manipulated to inject and execute operating system commands. This vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, potentially leading to full control over the router.

Reproduction

The vulnerability can be reproduced by sending a request to the httpd_debug.asp file with a crafted Time parameter that includes the injected command. This can be done manually or using an automated exploit, which is available on GitHub.