An unauthenticated remote code execution vulnerability in D-Link DAP-1360 allows remote attackers to gain full root access to the device, posing a severe risk to network security.

The device suffers from an OS command injection vulnerability (CWE-78) within the formSystemCheck handler of the web management interface. An unauthenticated attacker can exploit this by sending a crafted POST request to /apply.cgi with a malicious payload in the ipv4_ping parameter, resulting in command execution as the root user.

Successful exploitation allows an attacker to achieve full administrative control over the affected device without requiring credentials. This compromise enables the attacker to modify device configurations, intercept traffic, or pivot into the internal network, potentially leading to widespread data exposure and loss of infrastructure control. The CVSS score of 9.8 reflects the critical severity of this flaw, as it is both unauthenticated and allows for complete system takeover.

Immediate Action: As no specific patch version is currently available, users should restrict access to the device management interface by disabling remote management and ensuring the device is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at /apply.cgi and review system logs for unauthorized configuration changes or unexpected outbound connections originating from the device.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /apply.cgi endpoint containing suspicious characters or shell metacharacters in the ipv4_ping parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by d6fault.dev.

Given the critical nature of this vulnerability and the availability of a functional proof-of-concept, it is imperative that administrators take immediate steps to isolate affected DAP-1360 devices from external networks. If the device must remain in use, apply strict network-level access controls to limit management interface visibility to trusted internal IP addresses only, and monitor vendor support channels closely for the release of an official firmware update.