CVE-2013-10048 is a critical (CVSS 9.8) OS command injection in legacy D-Link routers, including DIR-300 rev B up to firmware 2.13 and DIR-600 up to 2.14b01. The unauthenticated command.php endpoint runs shell commands as root. No fix is confirmed, so replace unsupported units.
What's affected
Per the record and VulnCheck: DIR-300 rev B firmware up to 2.13 and DIR-600 firmware up to 2.14b01. VulnCheck states that the affected models and version range are not fully defined, so other related models may share the code.
The flaw is in the unauthenticated command.php endpoint. The record says specially crafted POST requests give a remote attacker shell commands with root privileges, including starting services such as Telnet, reading credentials and changing configuration.
I could not confirm a fixed firmware from the sources available. These are legacy routers, and the vendor's end of life policy should be checked for your model. A sibling record, CVE-2013-10069, covers the same endpoint from the angle of the cmd parameter. Routers like these can sit in home offices and small branches, so the list of affected units may include devices that staff use to reach your systems remotely.
How to check if you're exposed
Open the router admin page and read the model, hardware revision and firmware version from the status screen. DIR-300 rev B on 2.13 or earlier, and DIR-600 on 2.14b01 or earlier, are in scope.
Then find out whether the router answers from outside your network. From an external host:
nmap -p 80,8080,23 <router-wan-address>
An open web interface means remote management is on. An open Telnet port you did not enable is a sign of tampering, since the record describes attackers starting Telnet.
Check the vendor's support and end of life pages for the model.
What to do now
- Identify the model, revision and firmware of every D-Link router in your estate, including remote offices and homes of staff who connect to your network.
- Check D-Link support for fixed firmware. If the model is end of life, replace it.
- Turn off remote management and any services you do not use.
- After any suspected exposure, factory reset, install current firmware if available, set a new admin password and review DNS and forwarding settings.
- Keep a list of network devices and their support status so aging hardware gets replaced on a schedule.
Why it matters
The class is CWE-78 (OS Command Injection). A web handler builds a shell command from request data without checking it, so whoever sends the request chooses part of the command. Because the endpoint needs no login and the web server runs as root on these routers, the result is full control of the device.
Edge devices are the weak spot of many networks. They run old firmware, receive few updates and are rarely monitored. Once an attacker owns the router, traffic through it can be read or redirected.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Is there patched firmware?
I could not confirm a fixed version. Check D-Link support for your model, and plan replacement if it is end of life.
Is this the same as CVE-2013-10069?
They describe the same unauthenticated command.php weakness in the same router families. Treat them as one remediation.
Sources
Last reviewed: 19 October 2026.
