CVE-2023-25280: D-Link DIR-820L ping.ccp OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote root command injection, KEV-listed with a public exploit and near-maximum EPSS, on an end-of-life device with no patch.

What it is

The D-Link DIR-820L router firmware (DIR820LA1_FW105B03) fails to sanitize the ping_addr parameter passed to ping.ccp, allowing OS command injection. Because the flaw is remotely reachable without authentication, it exposes the router to full compromise, and the product is end-of-life with no fix expected.

Impact

An attacker can execute arbitrary commands as root on the device, gaining full control of the router. That enables traffic interception, credential theft, and use of the device as a persistent foothold in the network.

Attack surface

Reachable over the network via the ping.ccp endpoint with a crafted ping_addr parameter; the CVSS vector shows no privileges or user interaction required. No authentication is needed per the vector (PR:N).

Exploitation

It is listed in CISA KEV (added 2024-09-30) and has a public exploit reference, and EPSS is 0.97864 (99.9th percentile), indicating active exploitation is expected.

What to do

• Discontinue use of the D-Link DIR-820L; CISA's required action is to stop using the end-of-life product.
• Replace affected routers with a supported model that receives security updates.
• If the device cannot be removed immediately, isolate it on a separate network segment and block management/HTTP access from untrusted networks.
• Restrict remote access to the router's web interface and disable WAN-side administration where possible.
• Monitor for exploitation attempts against ping.ccp and treat any such device as compromised.

Detection

• Inspect HTTP requests to ping.ccp for command-injection characters or shell metacharacters in the ping_addr parameter.
• Monitor router logs and outbound traffic for unexpected command execution or connections from the device.
• Watch for anomalous processes or shell activity on the router if host-level visibility is available.
• Alert on any external access to the router's management interface from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.