D-Link · DIR-820 Router
CVE-2023-25280
D-Link DIR-820 Router OS Command Injection Vulnerability
What it is
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
CISA: D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
What to do
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Deadline for US federal agencies: October 21, 2024
More exploited flaws from D-Link
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 24, 2026 | Command Injection | DIR-823X | High 7.2 | 88% |
| Dec 8, 2025 | Buffer Overflow | Routers | Critical 9.8 | 56% |
| Aug 5, 2025 | Unspecified | DCS-2530L and DCS-2670L Devices | High 7.5 | 98% |
| Aug 5, 2025 | DCS-2530L and DCS-2670L Command Injection | DCS-2530L and DCS-2670L Devices | High 8.8 | 54% |
| Aug 5, 2025 | Download of Code Without Integrity Check | DNR-322L | High 8.8 | 34% |
| Jun 25, 2025 | D-Link DIR-859 Router Path Traversal | DIR-859 Router | Medium 5.3 | 83% |
| May 16, 2024 | Information Disclosure | DIR-605 Router | High 7.5 | 87% |
| May 16, 2024 | Cross-Site Request Forgery (CSRF) | DIR-600 Router | High 8.0 | 43% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.