D-Link AX1500 SetDeviceSettings `DeviceName` OS Command Injection (CVE-2025-60854)

Metadata

Affected Target

Summary

The D-Link AX1500 web management interface exposes a SetDeviceSettings SOAP action (reached via the /DHMAPI/ HNAP-style endpoint) that lets a client update the router’s DeviceName. The vulnerable firmware function (identified in the binary as save_CSID_SetDeviceSettings, IDA name sub_46AE00) passes the raw DeviceName value into a command line that is executed via exec_cmd/event_notifier. Before doing so it calls a filtering routine (sub_415D74) that percent-encodes a fixed set of characters (!#$&'()*+,/:;=?@[]%) but never touches the shell metacharacters |, `, or ". Because the value is embedded inside a double-quoted format string ("U=0&Y=261&I=0&D=%s"), an attacker-controlled DeviceName containing a " can close the quoted string early and a following | can chain arbitrary shell commands, which are executed with the privileges of the firmware’s event/service process — in the published PoC, spawning a telnetd root shell on a chosen port.

Vulnerability Details

Root Cause

sub_415D74, the sanitizer applied to the DeviceName field before it is interpolated into the event_notifier 3001 "U=0&Y=261&I=0&D=%s"& command string, percent-encodes the character set !#$&'()*+,/:;=?@[]% but omits ", `, and | from the encoded set (CWE-78: OS Command Injection / improper neutralization of special elements). Since the tainted value is placed inside a double-quoted argument, injecting an unescaped " terminates that argument early, and a subsequent |...| sequence is interpreted by the shell as a pipeline, letting arbitrary commands run.

Attack Vector

1. Obtain a signed session against the router’s SOAP/HNAP interface (/DHMAPI/) — the browser-console PoC operates from an already-open admin page so the existing page JavaScript (SOAPAction, SOAPGetDeviceSettingsResponse) can transparently sign/encrypt the request the same way the legitimate UI does.
2. Call GetDeviceSettings to preserve the device’s existing configuration values.
3. Call SetDeviceSettings with the DeviceName field set to a payload such as:

   "|telnetd -l ash -p 4545|true"
   

4. The firmware builds and runs:

   event_notifier 3001 "U=0&Y=261&I=0&D="|telnetd -l ash -p 4545|true""&
   

   which the shell splits into three commands — the legitimate event_notifier call, the injected telnetd -l ash -p 4545 (a shell bound to TCP port 4545), and a harmless true.
5. The attacker connects to the newly spawned telnetd service to obtain a root/service shell on the router.

Impact

Full command execution on the router’s embedded Linux OS as the privileged process handling device settings, effectively total device compromise (arbitrary shell access, further pivoting into the LAN, firmware tampering, persistent backdoor).

Environment / Lab Setup

Target:   D-Link AX1500 router, firmware 1.20.01 or earlier, web admin reachable at http://<router-ip>:<port>/
Attacker: Browser with developer console access to an authenticated admin session on the target router's management UI

Proof of Concept

PoC Script

See exploit.md (browser-console JS) and README.md’s decompiled analysis in this folder.

1. Open the router's admin web UI and log in / have an active admin session.
2. Open the browser developer console on that page.
3. Paste the setDeviceName() factory function from exploit.md to define window.setDeviceName().
4. Run: setDeviceName('"|telnetd -l ash -p 4545|true"');
5. Connect to the router on port 4545 with a telnet client to obtain a shell.

The console script wraps the page’s existing SOAPAction/SOAPGetDeviceSettingsResponse helpers to check connectivity, fetch the current device settings, then submit a SetDeviceSettings SOAP request with a malicious DeviceName, reusing the legitimate UI’s request signing so the payload reaches the vulnerable save_CSID_SetDeviceSettings firmware handler and triggers the injected telnetd command.

Detection & Indicators of Compromise

Signs of compromise:

• DeviceName configuration value containing ", `, or | characters
• Unexpected telnetd (or other shell/service) process running on a non-standard port on the router
• SOAP SetDeviceSettings POST requests to /DHMAPI/ with anomalous DeviceName fields in the XML body

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/K0n9-log/CVE-2025-60854 on 2026-07-06.