{"id":"CVE-2023-25280","aliases":["EUVD-2023-29242","GHSA-3pm3-vpvc-2wpp"],"status":"published","title":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate...","description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.97864,"percentile":0.99908,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2023-03-16T00:00:00Z","modified":"2026-06-17T05:41:01Z","kev":{"date_added":"2024-09-30","due_date":"2024-10-21","required_action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-09-30"},{"source":"kev","since":"2024-09-30"}],"exploits":[{"source":"nuclei","id":"CVE-2023-25280","title":"D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25280.yaml"}],"products":[{"vendor":"d-link","product":"dir-820 router"},{"vendor":"dlink","product":"dir-820l_firmware"},{"vendor":"dlink","product":"dir820la1_firmware"}],"references":[{"url":"https://www.dlink.com/en/security-bulletin/","tags":["x_transferred","Not Applicable"]},{"url":"https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25280"},{"url":"https://www.dlink.com/en/security-bulletin"},{"url":"https://github.com/advisories/GHSA-3pm3-vpvc-2wpp"}],"sources":{"cve":[{"id":"CVE-2023-25280","description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2025-10-21T23:15:22.929Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29242","description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2025-10-21T23:15:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-09-30","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-3pm3-vpvc-2wpp","title":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate...","description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","status":"published","published":"2023-03-16T03:30:17Z","modified":"2025-10-22T00:33:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2023-25280","title":"D-Link DIR-820 Router OS Command Injection Vulnerability","description":"D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","cwes":["CWE-78"],"kev":{"date_added":"2024-09-30","due_date":"2024-10-21","required_action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-25280","description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","status":"published","published":"2023-03-16T01:15:46.78Z","modified":"2026-06-17T05:41:01.463Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:49.031498Z"}]}}