CVE-2020-25367

CriticalCVSS 9.8

Published: 04/11/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.30%

95th percentile - higher than 95% of all known CVEs

Summary

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker can remotely execute arbitrary web scripts by sending shell metacharacters in the Captcha field during login.

Risk Assessment

The risk involves potential remote takeover of the device by an unauthenticated attacker, leading to network integrity compromise and access to sensitive data.

Recommendation

Immediately update the firmware to the latest version and, if possible, disable remote access to the management interface.

Original NVD description (English source)

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.