A critical command injection vulnerability in D-Link DIR-852 routers allows unauthenticated remote attackers to execute arbitrary code, posing a significant risk of full system compromise.

This vulnerability is a command injection flaw (CWE-77) located in the /HNAP1/ directory of the affected firmware. It allows unauthenticated remote attackers to inject and execute arbitrary system commands.

Successful exploitation of this vulnerability grants an attacker remote code execution capabilities on the device. This can lead to complete loss of confidentiality, integrity, and availability of the router, potentially enabling further lateral movement within the local network. Given the CVSS score of 7.3, this represents a significant security risk for environments still utilizing this end-of-life hardware.

Immediate Action: Since the product is no longer supported by the manufacturer, the immediate action is to decommission and replace the affected D-Link DIR-852 hardware.

Proactive Monitoring: Monitor network traffic for suspicious activity directed at the /HNAP1/ endpoint and review device logs for unauthorized command execution patterns.

Compensating Controls: If immediate replacement is not feasible, isolate the device behind a robust firewall and restrict access to the management interface to trusted internal segments only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

The D-Link DIR-852 is an end-of-life product and is no longer receiving security updates from the vendor. Organizations currently utilizing this device are at extreme risk of compromise due to the public availability of exploit details. It is strongly recommended to retire this hardware immediately and transition to a supported networking solution to ensure ongoing network security and integrity.