CVE-2025-52079

HighCVSS 8.8

Published: 21/10/2025(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

45th percentile - higher than 45% of all known CVEs

Summary

The administrator password setting of the D-Link DIR-820L 1.06B02 has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.

Risk Assessment

Unauthorized change of the administrator password may allow an attacker to take control of the device. This is a risk to the integrity and confidentiality of the network configuration.

Recommendation

Check for and apply a firmware update from D-Link. Until a fix is available, restrict access to the administrative interface and monitor configuration changes.

Other vulnerabilities in D-Link DIR-820L

CVE-2022-26258CriticalActively exploited
A remote command execution (RCE) vulnerability was discovered in D-Link DIR-820L version 1.05B03 via an HTTP POST request to the get set ccp function.

Original NVD description (English source)

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS