D-Link DIR-1253 EUVD-2026-43609

The specific prerequisite is reachability of the DIR-1253 component that mishandles the /etc/shadow credential file on firmware v1.0.1.250923.142435; abuse of that file yields or elevates privileges toward root. The CVSS vector asserts no authentication and network reachability (PR:N/AV:N/UI:N), so if the vulnerable interface is WAN- or LAN-exposed no credentials are needed - however, because the target is a local OS shadow file, exploitation is realistically limited to attackers who can reach the affected management/service endpoint (e.g., on the LAN or via exposed remote management), and units with remote administration disabled are not remotely exploitable. This AV:N-versus-local-file discrepancy is a limiting factor defenders should confirm against the vendor advisory before assuming internet-wide unauthenticated exploitability.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies trivial remote unauthenticated compromise, but this conflicts with the description, which points to /etc/shadow - a local OS credential file whose abuse normally presupposes some existing device access or a specific exposed service. This CVSS-vs-description conflict should be resolved with the vendor: if a network-facing endpoint leaks or writes /etc/shadow without authentication the 9.8 holds; otherwise real risk is lower and closer to a local or authenticated escalation. No EPSS score, KEV entry, or SSVC decision data was provided, so probabilistic and automatable-exploitation signals are unknown. The strongest concrete signal is the referenced public PoC (codeberg advisory#recent-poc / zuh.re), which raises practical risk, but PoC availability is not evidence of active exploitation. Net: treat as a high-priority patch target for exposed DIR-1253 units while noting the headline severity may be inflated relative to real-world preconditions.

An attacker with access to the router's exposed management interface (or a local/adjacent foothold on the LAN) invokes the vulnerable component to read or overwrite /etc/shadow, obtaining or replacing the root password hash. Using the publicly referenced PoC, they then authenticate as root and take full control of the router, enabling traffic interception, DNS hijacking, or use of the device as a pivot. Because low attack complexity is indicated, the operation needs no special timing or user interaction once the vulnerable interface is reachable.