D-Link DI-8200G Command Injection Vulnerability in Upgrade Filter ASP

A command injection vulnerability has been identified in the D-Link DI-8200G router, specifically in the firmware version 17.12.20A1. The issue arises in the file '/upgrade_filter.asp', where the 'path' argument can be manipulated to execute arbitrary commands. This vulnerability can be exploited remotely by sending crafted HTTP POST requests.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/upgrade_filter.asp' with the 'path' parameter set to a command, such as 'ls', which is then redirected to a file, like '1.txt'.