CVE-2013-5223: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

CVE-2013-5223 · Severity: critical · CVSS 5.4 · Exploited in the wild · Published 2022-03-25

Vendors: D-Link.

Executive brief

Multiple cross-site scripting (XSS) vulnerabilities in the D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via various parameters across multiple CGI and CMD scripts, including sntpcfg.cgi, ddnsmngr.cmd, and wlcfg.wl. The vulnerability is actively exploited in the wild according to CISA.

Affected products

D-Link DSL-2760U Gateway Revision E1

Timeline

2013-11-12: disclosed: Initial public disclosure via Full Disclosure mailing list and Packet Storm.
2022-03-25: kev added: Added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.