An unauthenticated command injection flaw in the cookie handling of the lighttpd web server on the D-Link DSP-W110A1 firmware allows attackers to send specially crafted cookie values that are processed unchecked. This vulnerability enables remote attackers to execute arbitrary commands on the underlying Linux operating system, resulting in full system compromise.

The affected device is the D-Link DSP-W110A1 router with firmware version 1.05B01. Users deploying this version should verify the build and apply an updated firmware that removes the vulnerability.

The flaw scores 9.3 on the CVSS scale; its EPSS score has been updated to 3%, indicating a low likelihood of exploitation. Although it is not yet listed in the CISA KEV catalog, the combination of unauthenticated access and remote code execution makes it a top priority to patch. The likely attack vector is remote network exploitation via HTTP requests to the device's web interface, where an attacker sends specially crafted cookie values that are processed unchecked, leading to arbitrary command execution on the underlying Linux OS.