A command injection flaw exists in the /upgrade_filter.asp script when the path argument is unsanitized. The flaw permits an attacker to inject and execute arbitrary operating‑system commands, leading to full control over the device. The vulnerability is a classic instance of OS command injection and falls under CWE‑74 and CWE‑77. The impact includes compromise of confidentiality, integrity, and availability of the router and any network traffic handled by it.

The vulnerability affects the D‑Link DI‑8200G router, specifically firmware version 17.12.20A1. No other vendor releases or firmware revisions are listed as affected. The flaw is tied to an unknown function within the upgrade_filter.asp file of this firmware build.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 0.09953% indicates a very low probability of exploitation. The flaw is not catalogued in the CISA KEV list. Nonetheless, the public disclosure of a working exploit means that an adversary with network access to the router’s administrative interface can trigger the injection remotely. Exact authentication prerequisites are not provided, and the description indicates the attack may be performed from any remote connection that can contact the web interface.