CVE-2020-9377VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2020-9377: D-Link DIR-610 Devices Remote Command Execution

Affects D-Link DIR-610 DevicesSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 21.3% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

nvd.nist.gov/vuln/detail/CVE-2020-9377 (opens in a new tab)

Description

D-Link DIR-610 devices are vulnerable to remote code execution through the cmd parameter in command.php. This vulnerability allows attackers to execute arbitrary commands remotely on affected devices. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Summary

The CVE-2020-9377 vulnerability affects D-Link DIR-610 devices, enabling remote attackers to execute arbitrary commands via the cmd parameter in the command.php endpoint. This is a command injection vulnerability categorized under CWE-78. Exploitation of this flaw can lead to full control over the affected device. The vulnerability has been observed in active exploitation campaigns.

Impact

Successful exploitation allows remote attackers to execute arbitrary commands on vulnerable D-Link DIR-610 devices, potentially leading to full device compromise. This can affect device availability, confidentiality, and integrity. The vulnerability is known to be exploited in the wild, increasing the risk to affected users.

Mitigation

No patch or official remediation information is provided. Users should consult D-Link for updates or advisories. Until a fix is available, restricting access to the device management interface from untrusted networks and disabling remote management features can reduce exposure. Monitor vendor channels for official patches or guidance.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:10:57 UTC

Weaknesses

References

Related threats