A command injection vulnerability in the D-Link DSL-7740C router allows privileged attackers to achieve full system compromise.

This vulnerability is a command injection flaw located in the ping6 function. Based on the CVSS vector (PR:H), the attacker must possess high-level administrative credentials to trigger the execution of arbitrary commands.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with administrative privileges on the affected device. This could lead to a total loss of confidentiality, integrity, and availability of the router, potentially serving as a pivot point for further attacks on the internal network. Given the CVSS score of 7.2, this represents a significant risk to network security and operational continuity.

Immediate Action: Monitor official D-Link security bulletins for the release of a firmware patch and apply it as soon as it becomes available.

Proactive Monitoring: Review administrative access logs for unusual activity and monitor network traffic for unexpected outbound connections originating from the router device.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Public Exploit Available: Yes, a proof-of-concept exists as documented in a GitHub gist reference.

The severity of this command injection vulnerability necessitates prompt attention from network administrators. While administrative privileges are currently required for exploitation, organizations must prioritize restricting management access to prevent unauthorized use of the vulnerable ping6 function. Ensure that all affected devices are tracked and updated once the vendor provides a corrected firmware version to eliminate this risk entirely.