Dsl 3782
Monthly
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.