CVE-2023-25280D-Link DIR-820 Router OS Command Injection Vulnerability

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

9.8 CRITICALEPSS 97.86%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 05:41 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Oct 21, 2024

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Details

CVE ID: CVE-2023-25280
Status: Analyzed
Assigner (CNA): mitre
Published: Mar 16, 2023
Last modified: 2026-06-17 05:41 UTC
Weaknesses: CWE-78

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-09 13:17 UTC.