A critical command injection vulnerability in the D-Link DIR-882 router firmware allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of complete device compromise.

The flaw resides in the prog.cgi and rc binaries, where user-supplied input to the SetSysLogSettings/IPAddress parameter is passed to a system command without sanitization. An unauthenticated remote attacker can trigger this via specially crafted HTTP requests to the web interface, resulting in arbitrary command execution.

Successful exploitation allows an attacker to gain full control over the router, which can be leveraged to intercept network traffic, launch further internal network attacks, or disable security infrastructure. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to network integrity and confidentiality, potentially leading to unauthorized access to sensitive business data.

Immediate Action: Disconnect the affected device from the internet until a vendor patch is released and applied. If possible, disable the web management interface or restrict access to trusted internal IP addresses only.

Proactive Monitoring: Review device logs for unusual traffic patterns or unexpected system configuration changes. Monitor the D-Link security bulletin page regularly for the release of a firmware update addressing this specific issue.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) capable of detecting and blocking malicious HTTP requests containing command injection payloads targeting the prog.cgi endpoint.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any organization utilizing the affected D-Link hardware. Administrators must prioritize isolating these devices from external networks immediately and ensure that all firmware updates are applied as soon as the vendor provides a resolution.