CVE-2017-8404

CVE-2017-8404 is a critical command injection vulnerability affecting D-Link DCS-1130 devices. It arises from improper sanitization of POST parameters, specifically "receiver1," which are passed directly to a system API within the libmailutils.so library during SMB folder configuration. This allows unauthenticated attackers to execute arbitrary commands on the device with full privileges. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or active exploitation have been identified, the high FAUCET Risk Score and EPSS indicate a significant potential for future exploitation.