Digest · Thursday

Security digest: March 16, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: D-Link DIR-820L CVE-2023-25280: Unpatchable Router RCE. Anyone with a D-Link DIR-820L (DIR-820) router still in service, including small branch offices, home offices of remote staff and forgotten lab or guest networks.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Mar 16, 2023 · Vulnerability · CVE-2023-25280

D-Link DIR-820L CVE-2023-25280: Unpatchable Router RCE

There is no patch and never will be: if a DIR-820L is still on any network you are responsible for, replace it now; if you have none, there is nothing to do.

Must act: Anyone with a D-Link DIR-820L (DIR-820) router still in service, including small branch offices, home offices of remote staff and forgotten lab or guest networks.

Can relax: Organizations with no DIR-820L hardware anywhere in their estate; no other D-Link product is covered by this CVE.

Inventory routers at branch, home-office, lab and guest sites and look for the DIR-820L model on the device label or admin page.
Replace every DIR-820L with a supported router; there is no firmware fix.
Until it is replaced, disable remote (WAN-side) management and restrict the admin page to a wired management host.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.