{"id":"CVE-2020-9377","kind":"vulnerability","aliases":["CVE-2020-9377"],"related":[],"title":"D-Link DIR-610 Devices: D-Link DIR-610 Devices Remote Command Execution","description":"D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.\n\nCISA required action: The impacted product is end-of-life and should be disconnected if still in use.","summary":"D-Link DIR-610 routers accept a cmd parameter at command.php that runs operating system commands without authentication checks. An attacker who can reach the router can run arbitrary commands on it and take control of the device.","severity":"critical","cvss":8.8,"epss":0.21338,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"D-Link DIR-610 Devices","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dir-610","exploited","infrastructure","routers","self-hosted"],"not_affected_if":["no-dir-610-in-use"],"how_to_check":"Identify any D-Link DIR-610 in the network, including its firmware version and whether its web admin interface is reachable from outside.","fix":"Disconnect the DIR-610 from the network if it is still in use, as CISA directs because the product is end-of-life.","status":"open","published_at":"2020-07-09T13:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:06+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:20:06Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the DIR-610 from the network if it is still in use, as CISA directs because the product is end-of-life.\nunknown","reach":"network","impact":"high","summary":"D-Link DIR-610 routers accept a cmd parameter at command.php that runs operating system commands without authentication checks. An attacker who can reach the router can run arbitrary commands on it and take control of the device.","category":"infrastructure","who_cares":["d-link","dir-610","routers","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router and takes full control","analyst_note":"Confirm which DIR-610 firmware versions are affected and whether the admin interface is exposed to the internet; check the CISA KEV entry and the NVD record for CVE-2020-9377.","how_to_check":"Identify any D-Link DIR-610 in the network, including its firmware version and whether its web admin interface is reachable from outside.\nunknown","needs_analyst":true,"not_affected_if":["no-dir-610-in-use"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2829,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':17A,20A '-610':5A,11A,26A,32B,43B,82C '-9377':18A,21A 'accept':45B 'action':96C 'allow':84C 'arbitrari':68B 'attack':60B 'authent':57B 'check':58B 'cisa':94C 'cmd':47B,90C 'code':86C 'command':14A,55B,69B 'command.php':50B,93C 'control':74B 'cve':16A,19A 'd':2A,8A,23A,29B,40B,79C 'd-link':1A,7A,22A,28B,39B,78C 'devic':6A,12A,77B,83C 'devices':27A 'dir':4A,10A,25A,31B,42B,81C 'disconnect':108C 'end':102C 'end-of-lif':101C 'execut':15A,87C 'exploit':33B 'host':38B 'impact':98C 'infrastructur':34B 'life':104C 'link':3A,9A,24A,30B,41B,80C 'oper':53B 'paramet':48B,91C 'product':99C 'reach':63B 'remot':13A,85C 'requir':95C 'router':35B,44B,65B 'run':52B,67B 'self':37B 'self-host':36B 'still':110C 'system':54B 'take':73B 'use':112C 'via':88C 'without':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-09T13:15:10+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-9377","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9377","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2020-9377","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9377","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-9377","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9377","severity":null,"published_at":"2020-07-09T13:15:10+00:00","modified_at":"2026-06-17T03:27:50+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}