CVE-2020-9377

What is the D-Link DIR-610?

The DIR-610 is an older consumer wireless router from D-Link, long past its end-of-life and end-of-service date — D-Link no longer ships security updates for it. Like many discontinued home routers, units still in service tend to belong to users who aren't tracking vendor support timelines and simply keep using working hardware indefinitely.

Overview

CVE-2020-9377 allows remote command execution via the cmd parameter passed to the router's command.php endpoint (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Because the device is end-of-life, CISA's guidance is to disconnect it entirely rather than expect a patch.

Technical Details

The command.php script accepts a cmd parameter and passes it to a system-level command execution function without adequate sanitization (CWE-78, OS command injection), allowing an attacker who can reach this endpoint to execute arbitrary commands with the router's operating privileges.

Discovery

Publicly tracked via NVD; consistent with a broader pattern of unauthenticated command-injection bugs found in low-cost consumer router firmware, where web management interfaces are built without hardening against malicious input.

Exploitation Context

CISA added this CVE to KEV in March 2022 based on confirmed exploitation. Given the device's end-of-life status and the simplicity of the exploitation primitive, this vulnerability is a natural target for IoT botnet operators scanning broad IP ranges for vulnerable, unpatched routers to recruit.

Remediation

1. Disconnect and retire any D-Link DIR-610 still in service — this device is end-of-life and D-Link is not issuing a fix.
2. Replace with a currently supported router that receives regular security updates.
3. If immediate replacement isn't possible, restrict the router's web management interface to LAN-only access with no WAN-side exposure.
4. Audit your network for other end-of-life D-Link or similar consumer router models that may carry similar unpatched command-injection risk.