Description

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-15T05:17:00.713Z",
  "pubdate": "2026-09-15T05:17:00.713Z",
  "executiveSummary": "A critical command injection vulnerability exists in the D-Link DSL-3782, specifically within the diagnostic testing functionality.\nThe vulnerability resides in the /cgi-bin/New_GUI/Set/Diagnostics.asp script, where improper input sanitization of the 'Addr' argument allows for the execution of arbitrary system commands.\nThis flaw enables remote, unauthenticated attackers to achieve unauthorized remote code execution (RCE) with the privileges of the underlying web service, typically root or administrative.\nThe impact is severe, potentially leading to full device compromise, exfiltration of sensitive configuration data, interception of network traffic, or participation in botnet activities.\nGiven that proof-of-concept exploit code has been publicly disclosed, the risk of exploitation by malicious actors is high.\nDefensive measures are complicated by the potential lack of vendor-provided firmware updates for this legacy product, necessitating strict network access controls to mitigate the exposure.",
  "technicalDetails": "The vulnerability is a classic command injection flaw located in the /cgi-bin/New_GUI/Set/Diagnostics.asp file, specifically impacting the system function component.\nThe root cause is the insecure handling of user-supplied input provided to the 'Addr' HTTP parameter. The application fails to properly sanitize or validate this parameter before passing it to a system-level command execution routine, such as a shell or a system call function.\nIn the context of the DSL-3782 firmware, the diagnostic functionality intended to perform network testing (like ping or traceroute) unsafely concatenates the 'Addr' input into a backend command string. An attacker can break out of the intended command context by injecting shell metacharacters such as ';', '|', or '&&'.\nThe attack flow proceeds as follows: 1) The attacker sends a specially crafted HTTP POST or GET request to the affected URL. 2) The malicious payload, embedded within the 'Addr' parameter, contains shell-sensitive characters followed by arbitrary commands (e.g., '127.0.0.1; telnetd -p 8888 -l /bin/sh'). 3) The web server processes the request and executes the injected payload in the context of the device's operating system, rather than strictly as a target address for a diagnostic utility.\nExploitation is possible remotely over the network without requiring prior authentication. Because the web server process in many embedded router environments operates with high privileges, the attacker gains the ability to execute commands with elevated system rights. This grants the attacker full control over the router's operating system, allowing for persistent backdoor installation, modification of firewall rules, or lateral movement within the local area network.\nThe lack of input validation and the execution of commands via shell interfaces represent significant security oversights in the firmware architecture. Since the exploit is publicly available, an attacker requires minimal technical expertise to weaponize the vulnerability, significantly increasing the probability of successful exploitation against vulnerable, internet-facing devices."
}