CVE-2020-25367
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker can remotely execute arbitrary web scripts by sending shell metacharacters in the Captcha field during login.
Risk Assessment
The risk involves potential remote takeover of the device by an unauthenticated attacker, leading to network integrity compromise and access to sensitive data.
Recommendation
Immediately update the firmware to the latest version and, if possible, disable remote access to the management interface.
Other vulnerabilities in D-Link DIR-823G
See all- CVE-2020-25368Critical
A command injection vulnerability was discovered in the HNAP1 protocol on D-Link DIR-823G devices running firmware V1.0.2B05. An attacker can remotely execute arbitrary system commands by sending a crafted login request with shell metacharacters in the PrivateLogin field.
- CVE-2020-25366Critical
A vulnerability in the /cgi-bin/upload_firmware.cgi component of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
- CVE-2026-15270High
A weakness has been identified in the web interface of D-link DIR-823G router version 1.0.2B05_20181207 in the file /etc/boa/boa.conf. Manipulation of this file can lead to a least privilege violation. The attack can be launched remotely but requires a high level of complexity.
- CVE-2026-11492Medium
A flaw in D-Link DIR-823G 1.0.2B05 in the vsftpd component allows remote violation of the least privilege principle.
- CVE-2025-60675Medium
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries. The vulnerability occurs because parsed fields from the /tmp/new_qos.rule configuration file are concatenated into command strings and executed via system() without any sanitization.
- CVE-2025-60671Medium
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.
Original NVD description (English source)
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.