CVE-2019-10891

CVE-2019-10891 is a critical command injection vulnerability affecting D-Link DIR-806 routers. An unauthenticated remote attacker can execute arbitrary shell commands by manipulating a parameter in the hnap_main function, which directly calls system() without proper validation. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, there is evidence of active exploitation by malware botnets, as reported by BleepingComputer, and it has garnered significant community discussion, despite a lack of public exploit modules in common frameworks.