CVE-2023-25279
Published: 13 March 2023
Summary
CVE-2023-25279 is a critical-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-820L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-25279 is an OS command injection vulnerability, tracked under CWE-78, that affects the D-Link DIR820LA1_FW105B03 firmware. The flaw permits unauthenticated remote attackers to inject and execute arbitrary operating system commands, resulting in privilege escalation to root.
An attacker can exploit the issue over the network with no credentials or user interaction required, achieving full control of the affected device by supplying a crafted payload to the vulnerable component.
D-Link has published a security bulletin addressing the device, available via the vendor's security page, though specific patch or firmware remediation details are referenced only at the high level in public sources.
The EPSS score for this CVE rose from a low baseline to a peak of 0.7193 before receding to the current value of 0.4387, indicating that exploitation interest emerged after disclosure. Public proof-of-concept material has been posted to GitHub repositories targeting the tools_AccountName command injection path.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29241
Vulnerability details
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.