CVE-2020-9377
D-Link DIR-610 Devices Remote Command Execution
Description
CVE-2020-9377 is a critical remote command execution vulnerability (CWE-78) in D-Link DIR-610 wireless router devices that allows an authenticated attacker to inject and execute arbitrary operating system commands on the device. The vulnerability exists in the web management interface, where user-supplied input is passed directly to a system command without proper sanitization, enabling OS command injection. CISA has confirmed active exploitation and added CVE-2020-9377 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 76.6% (94.4th percentile), this vulnerability poses a severe threat to networks using affected D-Link devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-610 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://gist.github.com/GouveaHeitor/131557f9de7d571f118f59805df852dc(Broken Link, Exploit, Patch, Third Party Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182(Exploit, Vendor Advisory)
- https://www.dlink.com.br/produto/dir-610/(Product, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9377(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-78 describes a weakness where software constructs an OS command using externally-influenced input without properly neutralizing special characters that could modify the intended command, allowing an attacker to execute arbitrary commands on the underlying operating system. In CVE-2020-9377, the D-Link DIR-610 web interface passes user-controlled parameters directly to system shell commands without adequate input validation or sanitization.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-9377 allows an authenticated attacker to execute arbitrary operating system commands on the D-Link DIR-610 router with the privileges of the web server process, which typically runs as root on embedded Linux-based devices. This means successful exploitation grants complete control over the router, including the ability to intercept, modify, or redirect all network traffic passing through the device. Confidentiality is fully compromised as the attacker can capture sensitive data including credentials, DNS queries, and unencrypted communications. Integrity is equally impacted as the attacker can modify firmware, DNS settings, and routing tables. Availability can be disrupted by rendering the device inoperable or using it as a launch point for further attacks within the network. The 94.4th percentile EPSS score reflects significant exploitation activity targeting IoT and router devices.
Exploit Maturity
CVE-2020-9377 is confirmed as actively exploited in the wild by CISA and is listed in the Known Exploited Vulnerabilities catalog. The EPSS score of 76.6% (94.4th percentile) indicates high real-world exploitation probability. Router and IoT device vulnerabilities are frequently targeted by botnets such as Mirai and its variants, which automatically scan for and exploit command injection flaws to recruit devices into distributed denial-of-service networks. The authentication requirement is a low barrier, as many D-Link devices retain default credentials or use weak passwords.
Remediation
- Check for firmware updates from D-Link for the DIR-610 device and apply any available patches immediately; if no patch is available, consider replacing the device with a supported model.
- Change default administrative credentials on the DIR-610 to strong, unique passwords to reduce the risk of authenticated exploitation.
- Restrict access to the web management interface to trusted IP addresses only, and disable remote management access from the WAN interface entirely.
- Place the affected device behind a firewall or access control list that limits management access to authorized administrators only.
- Monitor network traffic for indicators of compromise including unexpected outbound connections from the router, DNS setting changes, or signs of botnet activity such as participation in DDoS attacks.
Technical Details
CVE-2020-9377 is an OS command injection vulnerability (CWE-78) in the web management interface of D-Link DIR-610 wireless routers. The vulnerability exists because the device's web server passes user-supplied input from HTTP request parameters directly to system shell commands (typically via functions like system() or popen()) without sanitizing special characters such as semicolons, pipes, or backticks. An authenticated attacker can append arbitrary shell commands to legitimate parameters, which are then executed by the underlying Linux operating system with root privileges. The embedded nature of the device means there are no additional security controls such as SELinux or AppArmor to limit the impact of command injection, and successful exploitation provides unrestricted root-level access to the device.
Frequently Asked Questions
Is CVE-2020-9377 being actively exploited?
Yes. CVE-2020-9377 is confirmed as actively exploited in the wild by CISA and is listed in the KEV catalog. The EPSS score of 76.6% (94.4th percentile) reflects high exploitation probability, and router command injection vulnerabilities are frequently targeted by automated botnets.
What products are affected by CVE-2020-9377?
CVE-2020-9377 affects D-Link DIR-610 wireless router devices. These consumer and small-business routers are commonly deployed in home and small office environments.
How do I fix CVE-2020-9377?
Apply any available firmware updates from D-Link for the DIR-610. If no patch is available, replace the device with a supported model. In the interim, change default credentials, disable remote management, and restrict web interface access to trusted IPs.
How severe is CVE-2020-9377?
CVE-2020-9377 is rated CRITICAL and enables full remote command execution on the router with root privileges. Compromised routers can be used to intercept all network traffic, launch further attacks, or join botnets. The CISA KEV listing and 94.4th percentile EPSS score confirm active, widespread exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.