Dir 860L B1 Firmware
Monthly
Command injection in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers running firmware 203b01/203b03 allows an attacker who can reach the device on the same broadcast domain to execute arbitrary shell commands as root by supplying a crafted Hostname (DHCP option 12) string in a DHCP request. Exploitation requires LAN adjacency rather than Internet reachability - DHCP is not routable, so the source data's 'remote' label is constrained to local-network delivery - but needs no authentication and no user interaction against a default-running service (our assessment vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact). Publicly available exploit code exists and is linked from the references, EPSS is 3.80% (90th percentile), and there is no CISA KEV entry or other confirmation of active in-the-wild exploitation; no vendor-released patch has been identified, and both models are end-of-life hardware revisions.
Command injection in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers running firmware 203b01/203b03 allows an attacker who can reach the device on the same broadcast domain to execute arbitrary shell commands as root by supplying a crafted Hostname (DHCP option 12) string in a DHCP request. Exploitation requires LAN adjacency rather than Internet reachability - DHCP is not routable, so the source data's 'remote' label is constrained to local-network delivery - but needs no authentication and no user interaction against a default-running service (our assessment vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact). Publicly available exploit code exists and is linked from the references, EPSS is 3.80% (90th percentile), and there is no CISA KEV entry or other confirmation of active in-the-wild exploitation; no vendor-released patch has been identified, and both models are end-of-life hardware revisions.