CVE-2013-10069 is a critical (CVSS 9.8) unauthenticated OS command injection in the web interface of D-Link DIR-600 rev B (up to 2.14b01) and DIR-300 rev B (up to 2.13). The cmd POST parameter in command.php can start a Telnet service for a root shell. No fix is confirmed.
What's affected
Per the record and VulnCheck: DIR-600 rev B firmware up to 2.14b01 and DIR-300 rev B firmware up to 2.13. VulnCheck says that the affected models and version range are not fully defined.
This record overlaps with CVE-2013-10048. Both describe the unauthenticated command.php endpoint in the same router families. This one focuses on the cmd parameter and on the ability to start a Telnet service on a chosen port, which gives an interactive root shell.
I could not confirm a fixed firmware. Check D-Link support for each model and revision, and the end of life policy.
How to check if you're exposed
Read the model, revision and firmware version from the router admin page. Then look for signs of tampering. An unexpected open Telnet port on the router is the most useful one, because the record says the flaw can be used to start Telnet.
From inside your network:
nmap -p 23,80,8080 <router-lan-address>
From outside, test the router's WAN address the same way, only on networks you own. If remote management is open, close it.
Compare DNS servers and port forwarding rules on the device with what you expect.
What to do now
- Identify affected DIR-300 rev B and DIR-600 rev B units.
- Install fixed firmware only if D-Link provides one for your revision. Otherwise replace the router.
- Turn off remote administration, and keep the admin page off the internet.
- Factory reset a device you suspect was reached, then reconfigure with a new admin password.
- Track the support status of network devices so old models are replaced on a plan.
Why it matters
The class is CWE-78 (OS Command Injection). The handler passes request data to a shell without checking it, and there is no login in front of it. The record highlights a practical result: launching a Telnet service gives the attacker a persistent interactive shell as root.
That detail changes how you detect a compromise. A service that was not there before is a good indicator, and a quick port check from inside your network can find it. It is also why replacing end of life routers beats trying to monitor them.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Does this overlap with CVE-2013-10048?
Yes. Both describe unauthenticated command injection in command.php on the same router families. One remediation covers both.
What is a sign of compromise?
An unexpected open Telnet port on the router, since the record says the flaw can start a Telnet service.
Sources
Last reviewed: 19 October 2026.
