A critical command injection vulnerability in D-Link DIR-882 firmware allows unauthenticated attackers to achieve remote code execution on the device.

The flaw exists in the prog.cgi and rc binaries where DDNS parameters are improperly sanitized before being passed to a system shell execution function. An unauthenticated remote attacker can trigger this by sending specially crafted HTTP requests to the device web interface.

Successful exploitation allows an attacker to gain full control over the affected router, which acts as the gateway for the network. This facilitates unauthorized access to internal network segments, traffic interception, and potential pivot points for further attacks. With a CVSS score of 7.3, the risk of total device compromise and subsequent lateral movement poses a significant threat to organizational security.

Immediate Action: Monitor the D-Link security bulletin page for the release of an official firmware patch and deploy it to all affected routers as soon as it becomes available.

Proactive Monitoring: Review router logs for suspicious HTTP requests containing unexpected shell metacharacters or unauthorized attempts to modify DDNS settings.

Compensating Controls: Disable the web management interface on the WAN side and restrict access to the administration panel to trusted, internal-only IP addresses via firewall rules.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation through the web interface, this vulnerability represents a high-priority risk. Administrators should immediately restrict access to the device management interface and prepare to deploy the vendor firmware update once released to ensure long-term mitigation.