⚠ Actively exploited
Added to CISA KEV on 2024-09-30. Federal agencies required to patch by 2024-10-21. Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product..

CVE-2023-25280 — OS Command Injection in Dlink Dir-820l Firmware

CWE-78 — OS Command Injection8 documents8 sources
Severity
9.8CRITICALNVD
EPSS
93.1%
top 0.20%
CISA KEV
KEV
Added 2024-09-30
Due 2024-10-21
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Dlink Dir-820l Firmware
Timeline
PublishedMar 16
KEV addedSep 30
KEV dueOct 21
Latest updateNov 5
CISA Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Description

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-3pm3-vpvc-2wpp: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_ad↗2023-03-16
▶
CVEList
CVE-2023-25280: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_ad↗2023-03-16
▶
VulnCheck
D-Link DIR-820 Router OS Command Injection Vulnerability↗2023
▶

💥Exploits & PoCs

1
Nuclei
D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS D-Link DIR820 ping.ccp Command Injection Attempt (CVE-2023-25280)↗2024-11-05
▶

📋Vendor Advisories

1
CISA
D-Link DIR-820 Router OS Command Injection Vulnerability↗2024-09-30
▶
CVE-2023-25280 — OS Command Injection in Dlink | cvebase