PatchTheCVECVE-2013-10059: An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 runn
CVE-2013-10059 is a high-severity flaw (CVSS 7.2) affecting dir-615h firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vec
Why this priority
- High severity
- EPSS top 2%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 26.3% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2025-08-01 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Metasploit: D-Link DIR615h OS Command Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2013-10059?
dir-615h firmware: upgrade to newer than 8.04. Exact commands for each OS are on this page.
Is CVE-2013-10059 being exploited?
CVE-2013-10059 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2013-10059 affect?
CVE-2013-10059 affects dir-615h firmware. Severity is high (CVSS 7.2). An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr p
How urgent is CVE-2013-10059?
Priority 55/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference