VulnerabilityAnalyzed

CVE-2013-5223

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

KEVMEDIUM 5.4EPSS 33.6%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 33.57% probability · 98th percentile
CISA KEV: Listed 25 March 2022 · due 15 April 2022
Weakness: CWE-79
Affected: dlink/dsl-2760u firmware
Source: cve@mitre.org

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-5223

References

http://osvdb.org/99603Broken Link
http://osvdb.org/99604Broken Link
http://osvdb.org/99605Broken Link
http://osvdb.org/99606Broken Link
http://osvdb.org/99607Broken Link
http://osvdb.org/99608Broken Link
http://osvdb.org/99609Broken Link
http://osvdb.org/99610Broken Link
http://osvdb.org/99611Broken Link
http://osvdb.org/99612Broken Link
http://osvdb.org/99613Broken Link
http://osvdb.org/99615Broken Link
http://osvdb.org/99616Broken Link
http://packetstormsecurity.com/files/123976Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2013/Nov/76Exploit, Mailing List, Third Party Advisory
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88723Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/88724Third Party Advisory, VDB Entry
http://osvdb.org/99603Broken Link
http://osvdb.org/99604Broken Link
http://osvdb.org/99605Broken Link
http://osvdb.org/99606Broken Link
http://osvdb.org/99607Broken Link
http://osvdb.org/99608Broken Link
http://osvdb.org/99609Broken Link
http://osvdb.org/99610Broken Link
http://osvdb.org/99611Broken Link
http://osvdb.org/99612Broken Link
http://osvdb.org/99613Broken Link
http://osvdb.org/99615Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.