D-Link DIR895LA1 Command Injection Vulnerability in DHCP Daemon

A command injection vulnerability has been identified in the DHCP daemon service of the D-Link DIR895LA1 router, specifically in version 102b07. This vulnerability arises during the lease renewal process, where the DHCP hostname parameter is improperly sanitized before being appended to a system command. As a result, when a DHCP client sends a renewal request with a malicious hostname, it is possible to execute arbitrary commands with root privileges on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with root privileges on the affected device.