A firmware flaw in the D-Link DI-7100G C1 router allows attackers to inject arbitrary shell commands via the start_proxy_client_email function. The weakness stems from improper handling of user input, classifying it as a command injection vulnerability (CWE‑74 and CWE‑77). This command injection can be triggered remotely, enabling an attacker to run malicious commands on the device and potentially compromise its integrity and confidentiality.

The vulnerability affects the D-Link DI-7100G C1 model running firmware version 24.04.18D1. Only this specific firmware revision is confirmed to be vulnerable; the status of other firmware revisions is uncertain and is not explicitly stated in the description, so it is inferred that newer or older firmware may not be impacted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 3% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, but published exploits exist, implying that determined adversaries could target affected devices. The attack vector is inferred to be remote, likely over the network, as the function is accessible remotely and the description states the attack can be executed remotely.