D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to execute arbitrary commands via shell.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')