A critical command injection vulnerability in the D-Link DIR-895L router allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk to network integrity.

This vulnerability is a command injection flaw (CWE-77) located in the sendACK function within the udhcpcd/serverpacket.c file. The flaw is triggered via the Hostname argument and can be exploited by an unauthenticated remote attacker.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized control over the affected network device. This could lead to a full compromise of the router, enabling attackers to intercept network traffic, modify configuration settings, or gain a foothold for lateral movement into the internal network. Given the CVSS score of 8.3, this high-severity flaw represents a significant risk to organizational data confidentiality and operational continuity.

Immediate Action: Contact D-Link support or check the official vendor portal for firmware updates addressing this vulnerability, as no public patch is currently confirmed.

Proactive Monitoring: Monitor network traffic for unusual outbound connections originating from the router and review system logs for suspicious process execution or unexpected Hostname values.

Compensating Controls: Restrict access to the router management interface to trusted IP addresses only and disable unnecessary services such as TR-069 if they are not required for operation.

Public Exploit Available: Yes, a published proof-of-concept exists per the technical write-up found at the provided vendor reference.

The presence of a public proof-of-concept for an unauthenticated remote code execution vulnerability makes this issue an urgent priority. Organizations currently using the affected D-Link hardware should treat this as a high-risk exposure and implement strict network segmentation while awaiting a vendor-supplied firmware update.