CVE-2023-25280
Published: 16 March 2023
Summary
CVE-2023-25280 is a critical-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-820L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-25280 is an OS command injection vulnerability, tracked under CWE-78, that affects the D-Link DIR-820L router running firmware version DIR820LA1_FW105B03. The flaw resides in the ping.ccp endpoint and is triggered by unsanitized input supplied to the ping_addr parameter, enabling an attacker to inject and execute arbitrary operating-system commands.
An unauthenticated remote attacker can exploit the issue over the network by sending a crafted HTTP request containing a malicious ping_addr value. Successful exploitation grants the attacker root-level privileges on the device, allowing full control over its configuration, traffic, and connected systems.
D-Link has published a security bulletin addressing the vulnerability, and the issue appears in CISA’s catalog of known exploited vulnerabilities. The associated EPSS score has remained at a peak of 0.9311 since disclosure, indicating sustained exploitation interest.
Public proof-of-concept code demonstrating command injection via the ping interface is available on GitHub, confirming that working exploits have been shared in the open.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29242
Vulnerability details
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
- CWE(s)
- KEV Date Added
- 30 September 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the ping_addr parameter in ping.ccp to block OS command injection payloads.
Limits privileges of the web interface process so that successful injection cannot immediately yield root-level control of the router.
Mandates timely application of the vendor firmware patch that removes the unsanitized ping_addr code path.