CVE-2022-26258: D-Link DIR-820L router OS command injection via HTTP POST

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, active KEV listing, and near-certain EPSS score on an end-of-life device with no patch path.

What it is

D-Link DIR-820L firmware 1.05B03 contains an OS command injection flaw reachable through an HTTP POST request to the set ccp handler, allowing remote command execution. The device is end-of-life, so no firmware fix is expected and exposed units remain permanently at risk.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the router, gaining full control of the device and its network position.

Attack surface

Reachable over the network via HTTP POST to the set ccp endpoint; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Listed in CISA KEV since 2022-09-08 with a required action to disconnect the end-of-life product, and EPSS shows a 30-day probability of 0.91981 (99.8th percentile); public exploit references are tagged Exploit.

What to do

• No patch is available because the product is end-of-life; replace the DIR-820L or remove it from service.
• If replacement is not immediate, disconnect the device from the internet and restrict management access to a trusted internal segment.
• Disable remote administration and any WAN-facing HTTP management interface.
• Segment or isolate any remaining units so a compromised router cannot reach other internal assets.
• Inventory for DIR-820L units still deployed and track them for decommissioning.

Detection

• Monitor HTTP POST requests to the set ccp handler on DIR-820L management interfaces for command-injection patterns.
• Alert on unexpected outbound connections or new listening services originating from router management addresses.
• Review router logs and network flow data for anomalous command execution or shell activity tied to the device.
• Scan internal networks for DIR-820L management interfaces exposed beyond their intended segment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.