Pumkinbridge

**Name of the Vulnerable Software and Affected Versions** D-Link DAR-8000-10 up to 20230809 **Description** A critical issue affects the file /app/sys1.php, where the manipulation of the `cmd` argument with the input `id` leads to os command injection. This can be initiated remotely. The exploit has been disclosed publicly and may be used. The issue is related to errors in processing the invoked URL address, allowing a remote attacker to execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.