Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2020-9377 is a high-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-610 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
D-Link DIR-610 wireless routers contain an OS command injection vulnerability, identified as CVE-2020-9377 and assigned CWE-78. The flaw exists in the command.php script, which accepts an unsanitized cmd parameter that is passed directly to the underlying operating system. The vulnerability affects only devices that are no longer supported by the vendor.
An attacker with network access and a valid low-privileged account can send crafted HTTP requests containing arbitrary shell commands in the cmd parameter. Because the CVSS vector shows network attack vector, low complexity, and no user interaction, successful exploitation results in full command execution with impacts to confidentiality, integrity, and availability.
D-Link security advisory SAP10182 states that the DIR-610 has reached end-of-life and will receive no patches or ongoing support. The vendor directs users to the product page confirming the unsupported status and recommends replacing the device.
The published proof-of-concept on GitHub demonstrates direct remote command execution against exposed devices.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30198
Vulnerability Data
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V1.2.8V15.2.5
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.