CVE Feed

    Dashboard / CVE / CVE-2020-25367

    CVE-2020-25367

    A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.

    Published:Nov 4, 2021
    Last Modified:Nov 21, 2024
    EPS:Nov 4, 2021
    EPSS Score:0.30143
    CVSS Score:9.8

    Affected Products

    Vendor
    Dlink
    Product
    Dir-823g
    Vendor
    Dlink
    Product
    Dir-823g Firmware

    Exploits

    https://github.com/sek1th/iot/blob/master/dir823g_3.mdhttps://github.com/sek1th/iot/blob/master/dir823g_3.md

    Related CVEs

    CVE-2026-11492 (CVSS 2.1) — A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function o…
    CVE-2026-4193 (CVSS 5.5) — A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function G…
    CVE-2025-60671 (CVSS 5.4) — A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin…
    CVE-2025-60675 (CVSS 5.4) — A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin…
    CVE-2025-60332 (CVSS 7.5) — A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attacke…
    CVE-2025-60331 (CVSS 7.5) — D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in t…
    CVE-2025-2360 (CVSS 6.9) — A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulner…
    CVE-2025-2359 (CVSS 6.9) — A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the fu…
    CVE-2024-13030 (CVSS 6.9) — A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affe…
    CVE-2024-51023 (CVSS 8.8) — D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High