CVE-2020-25368
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A command injection vulnerability was discovered in the HNAP1 protocol on D-Link DIR-823G devices running firmware V1.0.2B05. An attacker can remotely execute arbitrary system commands by sending a crafted login request with shell metacharacters in the PrivateLogin field.
Risk Assessment
The risk involves potential full device takeover by an unauthenticated attacker, leading to network compromise, data theft, or the router being used as part of a botnet.
Recommendation
Immediately update the firmware of the D-Link DIR-823G device to the latest available version that fixes this vulnerability. If no update is available, consider replacing the device with a model that has current vendor support.
Original NVD description (English source)
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login.