CVE-2023-26613

An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands…

published June 29, 2023

CVSS
—
EPSS
31%
Percentile
98.3
In the wild
Unconfirmed
What it is

🚨 A crafted GET request is all it takes to send unauthorized commands to your D-Link DIR-823G! Think of this as a delivery driver who doesn’t check the package label and just drops anything off at your house. If they receive a note to ‘install this software,’ they might just do it without any questions! An attacker could potentially run any command they want on your device, leading to unauthorized access to your network and data. This could pave the way for further exploits, making your home network a playground for malicious activities!

Put simply

Think of this as a delivery driver who doesn’t check the package label and just drops anything off at your house. If they receive a note to ‘install this software,’ they might just do it without any questions! This vulnerability allows attackers to exploit the D-Link DIR-823G firmware version 1.02B05 by sending specially crafted GET requests to the EXCU_SHELL endpoint, enabling arbitrary command execution without proper authorization.

What to do

An attacker could potentially run any command they want on your device, leading to unauthorized access to your network and data. This could pave the way for further exploits, making your home network a playground for malicious activities! To mitigate this risk, update your D-Link DIR-823G firmware to the latest version as soon as possible. Regularly check for firmware updates and review any configurations to ensure that unauthorized access is prevented. 🛡️ You're on top of this! Keep your devices updated, and you'll be a security hero in no time! 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.31396 · 98.3th percentile
Published
2023-06-29T00:00Z
EPSS history
Timeline
  • 29 JUN 00:00Z
    An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands…
    cvelistv5