A vulnerability exists in the D-Link DCS-931L router, located in the /goform/setSysAdmin URL. Manipulating the AdminID parameter allows an attacker to inject arbitrary operating system commands, enabling full remote code execution on the device. The flaw is an example of OS Command Injection and System Call vulnerabilities, which compromise confidentiality, integrity, and availability of the managed network. The description notes that the exploit is publicly available and can be triggered remotely.

Affected products are the D-Link DCS-931L series running firmware versions up to 1.13.0. This includes any devices with that specific firmware revision; newer firmware should not be vulnerable. The product is no longer supported by the maintainer, so the risk remains until a patch or upgrade is applied.

With a CVSS score of 8.6, the vulnerability is high severity. The EPSS score is very low (< 1%), indicating limited public exploitation data, but the presence of publicly available proof‑of‑concept code raises concerns. The vulnerability is not listed in CISA’s KEV catalog, but the remote command injection capability is serious. The likely attack vector is a remote attacker sending a crafted AdminID parameter to the /goform/setSysAdmin endpoint, potentially from any network that can reach the router. The vulnerability does not require local access, and the exploit can be automated by malicious actors.