CVE-2023-25280

CRITICAL KEV NUCLEI

D-Link DIR-820L Firmware - OS Command Injection via ping_addr Parameter

Title source: llm

Exploitation Summary

CVE-2023-25280 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 30, 2024. A Nuclei detection template is also available.

Description

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

Nuclei Templates (1)

D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection

CRITICALby pussycat0x

References (3)

Core 3

Core References

Exploit, Third Party Advisory

https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg

Not Applicable

https://www.dlink.com/en/security-bulletin/

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280

Scores

CVSS v3 9.8

EPSS 0.9311

EPSS Percentile 99.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable yes

Technical Impact total

Details

CISA KEV 2024-09-30

VulnCheck KEV 2023-06-22

InTheWild.io 2024-09-30

ENISA EUVD EUVD-2023-29242

CWE

CWE-78

Status published

Products (1)

dlink/dir-820l_firmware 1.05b03

Published Mar 16, 2023

KEV Added Sep 30, 2024

Tracked Since Feb 18, 2026