A system command injection flaw exists in the udhcpd DHCP Service (dhcpd.c) of the D-Link DIR-822 A_101 firmware. Manipulating the Hostname argument of a DHCP request allows a remote attacker to inject arbitrary shell commands, effectively bypassing any authentication controls and enabling full code execution on the router. This problem is rooted in improper input validation (CWE‑74) and failure to safely construct system calls (CWE‑77). The consequence is total loss of confidentiality, integrity, and availability of the affected device.

The vulnerability is confined to the D-Link DIR‑822 series, specifically firmware version A_101, which is no longer supported by the manufacturer.

The CVSS score of 6.9 indicates a moderate severity flaw, yet the EPSS score of less than 1% suggests that current exploitation activity is low. The vulnerability is not listed in CISA KEV, meaning no known widespread exploitation has been reported. The attack can be initiated remotely by sending a crafted DHCP packet with a malicious Hostname field; no prior authentication or local access is required. An attacker who succeeds can execute arbitrary commands on the router, potentially taking full control of the device and its network traffic.