The vulnerability allows an attacker to execute arbitrary operating system commands by manipulating the sysCmd parameter in the /goform/formSysCmd endpoint of the D‑Link DIR‑513 firmware 1.10. This translates to remote command execution, giving the attacker full control over the device’s shell and compromising confidentiality, integrity, and availability. It is a classic OS command injection flaw covered by CWE‑77 and CWE‑78.

The flaw is present on the D‑Link DIR‑513 router running firmware version 1.10, a product that is no longer supported by the vendor and therefore not receiving official updates. Devices that still use this firmware are at risk if left exposed to the internet.

With a CVSS score of 5.3 and an EPSS probability of less than 1 %, the vulnerability is of moderate severity and currently unlikely to be widely exploited, yet published exploits exist. Because the attack vector is remote and can be performed over the web interface, any machine with the device exposed to the internet could be compromised. No listing in the CISA KEV catalog does not negate the need for remediation.