Sign-up

ID

VAR-202303-1392


CVE

CVE-2023-25280


TITLE

D-Link Systems, Inc.  of  DIR820LA1  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2023-005414

DESCRIPTION

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. D-Link Systems, Inc. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-25280 // JVNDB: JVNDB-2023-005414 // VULMON: CVE-2023-25280

AFFECTED PRODUCTS

vendor:dlinkmodel:dir-820lscope:eqversion:1.05b03

Trust: 1.0

vendor:d linkmodel:dir820la1scope:eqversion:dir820la1 firmware 105b03

Trust: 0.8

vendor:d linkmodel:dir820la1scope: - version: -

Trust: 0.8

vendor:d linkmodel:dir820la1scope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-005414 // NVD: CVE-2023-25280

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-25280
value: CRITICAL

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2023-25280
value: CRITICAL

Trust: 1.0

NVD: CVE-2023-25280
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202303-1303
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2023-25280
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-25280
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNNVD: CNNVD-202303-1303 // JVNDB: JVNDB-2023-005414 // NVD: CVE-2023-25280 // NVD: CVE-2023-25280

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-005414 // NVD: CVE-2023-25280

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202303-1303

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202303-1303

EXTERNAL IDS

db:NVDid:CVE-2023-25280

Trust: 3.3

db:JVNDBid:JVNDB-2023-005414

Trust: 0.8

db:CNNVDid:CNNVD-202303-1303

Trust: 0.6

db:VULMONid:CVE-2023-25280

Trust: 0.1

sources: VULMON: CVE-2023-25280 // CNNVD: CNNVD-202303-1303 // JVNDB: JVNDB-2023-005414 // NVD: CVE-2023-25280

REFERENCES

url:https://www.dlink.com/en/security-bulletin/

Trust: 2.5

url:https://github.com/migraine-sudo/d_link_vuln/tree/main/cmd%20inject%20in%20pingv4msg

Trust: 2.5

url:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2023-25280

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-25280

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-25280/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2023-25280 // CNNVD: CNNVD-202303-1303 // JVNDB: JVNDB-2023-005414 // NVD: CVE-2023-25280

SOURCES

db:VULMONid:CVE-2023-25280
db:CNNVDid:CNNVD-202303-1303
db:JVNDBid:JVNDB-2023-005414
db:NVDid:CVE-2023-25280

LAST UPDATE DATE

2025-11-18T15:22:52.231000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2023-25280date:2023-03-16T00:00:00
db:CNNVDid:CNNVD-202303-1303date:2023-03-22T00:00:00
db:JVNDBid:JVNDB-2023-005414date:2023-11-08T03:20:00
db:NVDid:CVE-2023-25280date:2025-11-03T18:18:59.080

SOURCES RELEASE DATE

db:VULMONid:CVE-2023-25280date:2023-03-16T00:00:00
db:CNNVDid:CNNVD-202303-1303date:2023-03-16T00:00:00
db:JVNDBid:JVNDB-2023-005414date:2023-11-08T00:00:00
db:NVDid:CVE-2023-25280date:2023-03-16T01:15:46.780