---
id: "CVE-2020-9377"
kind: "vulnerability"
aliases: ["CVE-2020-9377"]
title: "D-Link DIR-610 Devices: D-Link DIR-610 Devices Remote Command Execution"
severity: "critical"
cvss: 8.8
epss: 0.21338
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link DIR-610 Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "dir-610", "exploited", "infrastructure", "routers", "self-hosted"]
not_affected_if: ["no-dir-610-in-use"]
published_at: "2020-07-09T13:15:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9377", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-9377", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9377", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# D-Link DIR-610 Devices: D-Link DIR-610 Devices Remote Command Execution

D-Link DIR-610 routers accept a cmd parameter at command.php that runs operating system commands without authentication checks. An attacker who can reach the router can run arbitrary commands on it and take control of the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link DIR-610 Devices affected ? fixed ?

## How to check

Identify any D-Link DIR-610 in the network, including its firmware version and whether its web admin interface is reachable from outside.

## Fix

Disconnect the DIR-610 from the network if it is still in use, as CISA directs because the product is end-of-life.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9377
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-9377
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-9377

## From the sources

D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.

CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_