Vulnerability record · CVE-2023-4542 · published 25 August 2023
CVE-2023-4542: D-Link DAR-8000-10 sys1.php OS Command Injection
Dlink · Dar 8000 10 Firmware
D-Link DAR-8000-10 firmware up to 20230809 contains an OS command injection flaw in /app/sys1.php, where the cmd argument can be manipulated to execute arbitrary commands. The vulnerability is rated critical and a public exploit has been disclosed, making it a serious risk for exposed devices.
Description
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication required, public exploit code, and very high EPSS probability make this an urgent risk for exposed D-Link DAR-8000-10 devices.
What it is
D-Link DAR-8000-10 firmware up to 20230809 contains an OS command injection flaw in /app/sys1.php, where the cmd argument can be manipulated to execute arbitrary commands. The vulnerability is rated critical and a public exploit has been disclosed, making it a serious risk for exposed devices.
Impact
An unauthenticated remote attacker can execute arbitrary operating system commands on the device, leading to full compromise of confidentiality, integrity, and availability.
Attack surface
The flaw is reachable over the network via HTTP requests to /app/sys1.php, requiring no authentication or user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
A public exploit exists and is referenced in third-party advisories; EPSS indicates a high probability of exploitation (0.8603, 99.7th percentile), though the CVE is not listed in CISA KEV.
What to do
- Apply vendor patches or firmware updates for D-Link DAR-8000-10 as soon as they become available.
- If no patch exists, restrict access to the device management interface to trusted networks only.
- Disable or block external access to /app/sys1.php and other administrative endpoints.
- Monitor vendor communications for a fix, as the vendor did not respond to the initial disclosure.
Detection
- Inspect HTTP requests to /app/sys1.php for suspicious cmd parameter values containing shell metacharacters or command sequences.
- Monitor device logs for unexpected command execution or process creation on the DAR-8000-10.
- Use network detection to alert on outbound connections from the device to unknown hosts, which may indicate command-and-control or data exfiltration.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/PumpkinBridge/cve/blob/main/rce.md | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.238047 | Permissions RequiredThird Party Advisory |
| https://vuldb.com/?id.238047 | Third Party Advisory |
| https://github.com/PumpkinBridge/cve/blob/main/rce.md | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.238047 | Permissions RequiredThird Party Advisory |
| https://vuldb.com/?id.238047 | Third Party Advisory |
Track CVE-2023-4542 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-4542), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
