CVE-2013-10050

🗓️ 01 Aug 2025 20:39:00Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Unauthenticated remote code execution in D-Link routers via tools_vct.xgi due to input sanitization failure.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2013-10050	1 Aug 202520:39	–	attackerkb
BDU FSTEC	The vulnerability of the web interface of D-Link DIR-300 and DIR-600 microprogrammed software routers allows a hacker to execute arbitrary commands.	8 Aug 202500:00	–	bdu_fstec
Circl	CVE-2013-10050	29 May 201815:50	–	circl
CNNVD	D-Link DIR-615和D-Link DIR-300 安全漏洞	1 Aug 202500:00	–	cnnvd
Cvelist	CVE-2013-10050 D-Link Devices tools_vct.xgi Authenticated RCE	1 Aug 202520:39	–	cvelist
EUVD	EUVD-2013-7273	7 Oct 202500:30	–	euvd
NVD	CVE-2013-10050	1 Aug 202521:15	–	nvd
OpenVAS	D-Link DIR-300 Multiple Vulnerabilities (2011 - 2024)	16 May 202500:00	–	openvas
Positive Technologies	PT-2025-31687	15 Oct 201200:00	–	ptsecurity
RedhatCVE	CVE-2013-10050	4 Aug 202509:32	–	redhatcve

NVD

Vulners

CNA

Node

dlink dir-300_firmwareRange≤1.05

AND

dlink dir-300Matcha

Node

dlink dir-615_firmwareRange≤4.13

AND

dlink dir-615Matchd

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "tools_vct.xgi"
    ],
    "product": "DIR-300 rev A",
    "vendor": "D-Link",
    "versions": [
      {
        "lessThanOrEqual": "1.05",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "tools_vct.xgi"
    ],
    "product": "DIR-615 rev D",
    "vendor": "D-Link",
    "versions": [
      {
        "lessThanOrEqual": "4.13",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
web	www.web.archive.org/web/20140830203110/http://www.s3cur1ty.de/m1adv2013-014
exploit-db	www.exploit-db.com/exploits/25024
vulncheck	www.vulncheck.com/advisories/d-link-legacy-unauth-rce-2
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir300_exec_telnet.rb
exploit-db	www.exploit-db.com/exploits/27428
exploit-db	www.exploit-db.com/raw/25024

Parameter	Position	Path	Description	CWE
pingIp	query param	/tools_vct.xgi	OS command injection via pingIp parameter in tools_vct.xgi CGI on vulnerable D-Link routers	CWE-78

16 Jun 2026 23:50Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.8

CVSS 48.7

EPSS0.09637

SSVC

CWE-78