Attack Chain

1. Attacker performs network reconnaissance to identify reachable D-Link DSL-3782 management interfaces.
2. Attacker crafts a malicious HTTP GET or POST request targeting the /cgi-bin/New_GUI/Set/Diagnostics.asp endpoint.
3. Attacker injects shell metacharacters or command strings into the 'Addr' parameter (e.g., ; id or | /bin/sh).
4. The router's web server processes the request and passes the tainted 'Addr' value to a system-level function without proper sanitization.
5. The underlying operating system executes the attacker-supplied command with root or administrative privileges.
6. The attacker establishes a reverse shell or downloads a malicious payload to gain persistent access to the device.
7. Final objective: The device is recruited into a botnet or used as a pivot point for lateral movement into the local network.

Impact

Successful exploitation allows for full system control over the affected D-Link DSL-3782 router. This can lead to unauthorized network monitoring, traffic interception, internal network reconnaissance, and the deployment of malware. As this device is a consumer-grade router, impact includes potential data exfiltration and complete loss of confidentiality and integrity for all traffic traversing the device.

Recommendation

• Monitor network traffic for anomalous HTTP requests directed at /cgi-bin/New_GUI/Set/Diagnostics.asp containing shell metacharacters.
• Disconnect affected D-Link DSL-3782 devices from the public internet immediately.
• If a firmware update is unavailable, ensure the web management interface is not accessible from the WAN side.
• Implement egress filtering on the gateway to detect and block non-standard outbound connections originating from network infrastructure components.