Security readout for executives and security teams
Plain-English summary
Legacy D-Link DIR-300 rev A and DIR-615 rev D routers can be fully compromised through command injection in the web management ping feature. Sources describe valid credentials required, despite the title/advisory wording saying unauthenticated. No vendor patch is identified and affected models are end-of-life, so response should focus on identifying and replacing exposed legacy devices.
Executive priority
Prioritize discovery and replacement where these routers support business connectivity or remote sites. Because there is no patch identified and public exploit material exists, compensating controls are temporary. Internet-exposed or shared-credential devices should be treated as urgent remediation candidates.
Technical view
CWE-78 OS command injection affects tools_vct.xgi via the pingIp parameter on firmware exposing Mathopd/1.5p6, confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13. CVSS v4.0 is 8.7 with network access, low complexity, low privileges, no user interaction, and high device confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely in small-office, branch, home-office, or unmanaged network environments still running legacy D-Link DIR-300 rev A or DIR-615 rev D devices. Internet-facing management interfaces materially increase risk. The provided affected version data is limited and should be validated against actual firmware and model inventory.
Exploitation context
The bundle cites public exploit references and a Metasploit module, indicating mature public knowledge. It does not cite CISA KEV listing or confirmed active exploitation. The source bundle is internally inconsistent on authentication, so treat exposure requiring credentials as the better-supported detail unless vendor records prove otherwise.
Researcher notes
Key uncertainty: the title and VulnCheck-style wording say unauthenticated RCE, while the description, CVSS PR:L, and endpoint context indicate authenticated exploitation. Do not broaden affected products beyond DIR-300 rev A and DIR-615 rev D without additional evidence. Public exploit references should be used only for defensive validation planning.
Mitigation direction
- Identify and replace affected end-of-life D-Link routers.
- Remove web management interfaces from internet exposure.
- Restrict administration to trusted management networks only.
- Review D-Link guidance; no vendor patch is identified in the bundle.
- Rotate device credentials and audit configuration after suspected exposure.
Validation and detection
- Inventory D-Link router models and hardware revisions.
- Check firmware versions against DIR-300 rev A v1.05 and DIR-615 rev D v4.13.
- Confirm whether tools_vct.xgi is present on management interfaces.
- Identify devices exposing Mathopd/1.5p6 web management.
- Review logs or configuration for unexpected administrative changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2013-10050 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir300_exec_telnet.rbCVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/25024CVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/27428CVE reference, VulnCheck · exploit
- https://web.archive.org/web/20140830203110/http://www.s3cur1ty.de/m1adv2013-014CVE reference, VulnCheck · technical-description, exploit
- https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce-2CVE reference, VulnCheck · third-party-advisory
- https://www.exploit-db.com/raw/25024CVE reference, CISA-ADP · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.