CVE-2013-10059
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 26.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 26.30% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- dlink/dir-615h firmware
- Source
- disclosure@vulncheck.com
EPSS moved from 26.6% on 21 September 2026 to 26.3% on 1 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rbExploit
- https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008Third Party Advisory
- https://www.exploit-db.com/exploits/24477Exploit
- https://www.exploit-db.com/exploits/25609Exploit
- https://www.vulncheck.com/advisories/d-link-legacy-os-command-injectionThird Party Advisory
- https://www.exploit-db.com/exploits/24477Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.