CVE-2019-8316

CVE-2019-8316 is a critical command injection vulnerability affecting D-Link DIR-878 routers with firmware 1.12A1. A remote attacker can exploit this flaw by sending a crafted POST request to the /HNAP1 endpoint, specifically manipulating the WebFilterURLs field within the SetWebFilterSettings API function. This allows for arbitrary operating system command execution and root shell access. The vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for CVE-2019-8316 are minimal, suggesting a lack of widespread attention or public awareness. While not on the CISA KEV catalog or Hot List, the high FAUCET Risk Score of 72/100 underscores its potential danger.