CVE-2023-25280
D-Link DIR-820 Router OS Command Injection Vulnerability
Description
CVE-2023-25280 is a critical OS command injection vulnerability in the D-Link DIR-820L wireless router, firmware version 1.05B03, that allows unauthenticated remote attackers to escalate privileges to root through a crafted payload in the ping_addr parameter of the ping.ccp functionality. An attacker can exploit this flaw to execute arbitrary operating system commands with full administrative privileges on the device. With a CVSS v3.1 base score of 9.8 and the worst-case exploitability metrics, the vulnerability provides complete unauthenticated control over the affected router. CISA has added CVE-2023-25280 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 21, 2024, and the EPSS score of 92.75% at the 99.7th percentile confirms widespread exploitation targeting these consumer-grade network devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-820l firmware | 1.05b03 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg(Exploit, Third Party Advisory)
- https://www.dlink.com/en/security-bulletin/(Not Applicable)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280(US Government Resource)
Weakness Type
OS Command Injection via ping_addr Parameter
CVE-2023-25280 is an operating system command injection vulnerability in the D-Link DIR-820L router's diagnostic ping functionality. The ping.ccp endpoint accepts a ping_addr parameter intended to receive an IP address or hostname for network diagnostic purposes. However, the firmware fails to sanitize this input before incorporating it into an operating system command executed through a shell. An attacker can inject shell metacharacters and arbitrary commands through the ping_addr parameter, which are then executed by the router's operating system with root privileges. This is a common vulnerability pattern in consumer and small-office router firmware where input validation is insufficient for web interface parameters that interact with system commands.
Impact Analysis
Confidentiality is fully compromised by CVE-2023-25280. Root-level command execution on a home or small-office router grants the attacker access to all traffic flowing through the device, stored Wi-Fi credentials, administrative passwords, connected device lists, and any network configuration data. The DIR-820L is a consumer wireless router typically deployed at the network boundary, giving an attacker visibility into all internet-bound communications of connected users.
Integrity faces maximum impact because root access allows the attacker to modify all device configurations, alter DNS settings to redirect users to malicious sites, inject malicious firmware, modify firewall rules, and install persistent backdoors that survive device reboots. DNS hijacking through a compromised home router is particularly dangerous because it can redirect banking, email, and other sensitive services to attacker-controlled phishing pages without the user's knowledge.
Availability is completely compromised since the attacker can disable the router, brick the device through malicious firmware modification, or conscript it into a botnet for distributed denial-of-service attacks. The EPSS score of 92.75% at the 99.7th percentile is among the highest possible, confirming that this vulnerability is massively exploited, likely by automated botnet recruitment campaigns. While the ransomware association is listed as unknown, compromised consumer routers are commonly weaponized into botnets such as Mirai and its variants, used as proxies for criminal infrastructure, or leveraged for DNS-based attacks against the router's users.
Exploit Maturity
CVE-2023-25280 demonstrates the highest level of exploit maturity with massive automated exploitation confirmed. Its inclusion in CISA's Known Exploited Vulnerabilities catalog and an EPSS score of 92.75% at the 99.7th percentile place it among the most actively exploited vulnerabilities in consumer network equipment.
A detailed proof-of-concept exploit is publicly available on GitHub, providing complete exploitation details. D-Link has published a security bulletin addressing the vulnerability, though the DIR-820L has reached end-of-life status, meaning no firmware fix is expected. The exploitation is trivially simple, requiring only an HTTP request with shell metacharacters in the ping_addr parameter. The unauthenticated nature (PR:N), no user interaction requirement (UI:N), network accessibility (AV:N), and low complexity (AC:L) combined with publicly available exploit code make this vulnerability actively targeted by automated scanning and botnet recruitment campaigns. Consumer routers are particularly vulnerable because they are rarely updated, often left with default configurations, and may have management interfaces inadvertently exposed to the internet.
Remediation
-
Replace the D-Link DIR-820L with a currently supported router. The DIR-820L has reached end-of-life and D-Link has indicated that no firmware fix will be provided. The only effective remediation is replacing the device with a currently supported router model that receives security updates. This is the most critical recommendation given the severity and active exploitation.
-
Disable remote management immediately. If replacement is not immediately possible, ensure that the router's web management interface is not accessible from the WAN (internet) side. Disable any remote management features and ensure the management interface is only accessible from the local network.
-
Restrict LAN access to the management interface. Configure the router to only allow management access from specific trusted devices on the local network. While this does not prevent exploitation from the LAN, it reduces the attack surface by limiting which devices can reach the vulnerable endpoint.
-
Monitor network traffic for indicators of compromise. Watch for unusual DNS query patterns from the router, unexpected outbound connections to unfamiliar IP addresses, degraded network performance, or sudden changes in DNS resolution behavior that could indicate the router has been compromised and is being used for DNS hijacking or botnet participation.
-
Segment the network to limit the compromised device's impact. If the DIR-820L must remain in service temporarily, place it behind a more secure network device or use it only as a wireless access point with routing handled by a patched device. Avoid passing sensitive traffic through a known-vulnerable gateway.
Technical Details
CVE-2023-25280 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a critical base score of 9.8. Every exploitability metric represents the worst case: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N).
The vulnerability exists in the ping diagnostic functionality of the D-Link DIR-820L router running firmware version DIR820LA1_FW105B03. The ping.ccp endpoint exposes a web-accessible interface for network diagnostics that accepts a ping_addr parameter specifying the target address to ping. Internally, the firmware constructs a shell command by concatenating the user-supplied ping_addr value into a command string that is passed to a system() or popen() call. Because the input is not sanitized for shell metacharacters, an attacker can inject additional commands by including characters such as semicolons (;), pipe operators (|), or command substitution syntax.
The injected commands execute with root privileges because the web server process on the DIR-820L runs as root, which is standard for consumer-grade embedded Linux routers that lack privilege separation. This means any injected command has unrestricted access to the device's operating system, file system, and network interfaces. The scope is unchanged (S:U), meaning the vulnerability directly impacts the router itself, but the practical consequences extend to all devices and traffic that depend on the router for network connectivity and DNS resolution. The affected firmware version 1.05B03 is the latest available for the DIR-820L, and since the device has reached end-of-life, no patched firmware will be released by D-Link.
Frequently Asked Questions
What is CVE-2023-25280?
CVE-2023-25280 is a critical OS command injection vulnerability in the D-Link DIR-820L router that allows an unauthenticated remote attacker to execute commands as root through the ping diagnostic functionality. With a CVSS score of 9.8, it provides complete control over the router and is actively exploited in massive automated campaigns.
Will D-Link release a patch for the DIR-820L?
No. The D-Link DIR-820L has reached end-of-life status, and D-Link has indicated that no firmware updates will be provided for this model. The only effective remediation is replacing the device with a currently supported router that receives security updates.
How are attackers exploiting this vulnerability?
Attackers send specially crafted HTTP requests to the router's ping.ccp endpoint with shell metacharacters in the ping_addr parameter. This is typically done through automated scanning and exploitation tools that search for vulnerable devices across the internet. Compromised routers are commonly recruited into botnets, used as proxies, or modified to perform DNS hijacking against connected users.
Is my DIR-820L router exposed to this vulnerability?
If you own a D-Link DIR-820L running firmware 1.05B03, your device is vulnerable. The risk is highest if the router's management interface is accessible from the internet, but even LAN-only access is concerning because any malicious device or script on your local network could exploit the vulnerability. Replacing the device is strongly recommended.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.