The vulnerability of the set_sta_enrollee_pin.cgi component of D-Link’s router microprogramming systems, DIR-825 and TEW-632BRP, allows a hacker to execute arbitrary commands.

The vulnerability of the setstaenrolleepin.cgi component of D-Link’s router microprogramming systems, such as DIR-825 and TEW-632BRP, exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor...

CVE-2020-10213: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...