D-Link DIR-820 Router OS Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-09-30
• EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

CISA: D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Oct 2024): The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4MsgExploitThird Party Advisory
• www.dlink.com/en/security-bulletinNot Applicable
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource