A firmware flaw in the D-Link DI-7100G C1 router allows attackers to inject arbitrary shell commands via the start_proxy_client_email function. This command injection can be triggered remotely, enabling an attacker to run malicious commands on the device and potentially compromise its integrity and confidentiality.

The vulnerability affects the D-Link DI-7100G C1 model running firmware version 24.04.18D1. Only this specific firmware revision is confirmed to be vulnerable; newer or older firmware may not be impacted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, but published exploits exist, implying that determined adversaries could target affected devices. The attack vector is inferred to be remote, likely over the network, as the function is accessible remotely and the description states the attack can be executed remotely.