CVE-2021-28144

CVE-2021-28144 is a critical command injection vulnerability affecting D-Link DIR-3060 devices running firmware versions prior to 1.11b04 HF2. An authenticated attacker can exploit a flaw in the prog.cgi script, specifically within the SetVirtualServerSettings function's call to CheckArpTables, to execute arbitrary commands with administrative or root privileges. This vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability compromise. While there is no evidence of active exploitation in the wild and no public exploit code available in Metasploit or ExploitDB, the vulnerability has garnered some community discussion, as noted by a Reddit advisory.