Security Digest · Mar 16, 2023 · Vulnerability · Network edge
D-Link DIR-820L CVE-2023-25280: Unpatchable Router RCE
Root command injection in end-of-life D-Link DIR-820L routers, used by Mirai botnets and in CISA KEV. No patch exists or will exist; replace the device.
Our verdict
Check exposure
There is no patch and never will be: if a DIR-820L is still on any network you are responsible for, replace it now; if you have none, there is nothing to do.
Who must act: Anyone with a D-Link DIR-820L (DIR-820) router still in service, including small branch offices, home offices of remote staff and forgotten lab or guest networks.
Who can relax: Organizations with no DIR-820L hardware anywhere in their estate; no other D-Link product is covered by this CVE.
- Affected
- D-Link DIR-820L (rev A1) firmware 1.05B03 (DIR820LA1_FW105B03)
All DIR-820L hardware revisions are end-of-service since Nov 1, 2017 and receive no fixes - Fixed in
- None. D-Link will not release a fix; replace the router.
- CVSS
- 9.8 (v3.1, NVD)
- EPSS
- 97.9% (percentile 99.9)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- Critical
What to do
- Inventory routers at branch, home-office, lab and guest sites and look for the DIR-820L model on the device label or admin page.
- Replace every DIR-820L with a supported router; there is no firmware fix.
- Until it is replaced, disable remote (WAN-side) management and restrict the admin page to a wired management host.
- Change the router admin and Wi-Fi passwords, and assume credentials stored on it were exposed.
- After replacement, scan the network segment behind it for other end-of-life devices.
How to check if you are affected or compromised
- Search web proxy, IDS or upstream logs for POST requests to /ping.ccp with ccp_act=pingV4Msg and a ping_addr value containing %0a, wget or curl.
- Check for outbound connections to the Unit 42 indicators zvub[.]us, 185.225.74[.]251, 185.44.81[.]114 and 193.32.162[.]189.
- Look for unexplained outbound traffic bursts or telnet scanning from the router's WAN address, typical of a Mirai bot.
- Treat any DIR-820L that was reachable from the internet as compromised; a reboot may clear the bot but not the hole.
What happened#
CVE-2023-25280 is an OS command injection flaw in the D-Link DIR-820L router (firmware DIR820LA1_FW105B03). The router's /ping.ccp handler passes the ping_addr parameter into a shell command. Its input filter does not block newline characters (%0a) or $, so one crafted POST runs commands as root. A researcher's write-up was published in February 2023, and the CVE record followed on March 16, 2023. NVD scores it CVSS 3.1 9.8. CISA describes it as exploitable by a remote, unauthenticated attacker.
Exploitation started quickly. Palo Alto Networks Unit 42 reported in June 2023 on a Mirai variant campaign that targeted about two dozen IoT flaws. It first saw this CVE in that traffic on April 11, 2023. Infected devices download an architecture-specific bot and are used for DDoS attacks.
Who is affected#
Only DIR-820L routers. In its SAP10358 notice, D-Link lists the DIR-820L as end-of-service since November 1, 2017, for all regions and hardware revisions, with "Not Available" under fixed firmware. That notice was written for an earlier Mirai variant (IZ1H9) that used two older DIR-820L bugs, CVE-2015-1187 and CVE-2021-45382. CISA's KEV catalog also lists a third DIR-820L RCE, CVE-2022-26258. On this hardware, CVE-2023-25280 is one more way in among several.
Do you really need to act?#
Only if you still have one, and then the answer is yes. CISA added the CVE to the KEV catalog on September 30, 2024, 18 months after Unit 42's report. The CISA alert cites only "evidence of active exploitation." It does not name the campaign or the reporter that prompted the 2024 listing, and we found no public report explaining the timing. The required action is not a patch: "The impacted product is end-of-life... Users should discontinue utilization of the product."
The realistic exposure is small offices, remote workers' homes and forgotten guest or lab networks. Botnets scan the whole internet, so obscurity does not help. A compromised router can also see and redirect the traffic of everything behind it.
What to do now#
- Find any DIR-820L. Check device labels and the admin page's model and firmware fields at branch, home-office and lab sites. Sweep subnets for admin web interfaces, for example
nmap -p 80,443,8080 --open 192.168.0.0/24, and open each one you don't recognize. - Replace it with a supported router. Reflashing the last firmware or a factory reset does not remove the bug, and D-Link does not support third-party firmware. D-Link offers US owners a discounted replacement in SAP10358.
- Until the swap, turn off remote (WAN-side) management, restrict the admin page to a single wired host, and set strong, unique admin and Wi-Fi passwords.
- After replacement, rotate any credentials that were configured on or passed through the old router, such as PPPoE, VPN and Wi-Fi keys.
How to tell if you were hit#
The Mirai variant Unit 42 analyzed deletes its downloaded file after it runs, so look at the network. Search upstream proxy or IDS logs for POSTs to /ping.ccp with ccp_act=pingV4Msg and a ping_addr containing %0a, wget or curl. Check for connections to the Unit 42 indicators zvub[.]us, 185.225.74[.]251, 185.44.81[.]114 and 193.32.162[.]189. Watch for unexplained outbound floods or telnet scanning from the router's WAN address. Any DIR-820L that was reachable from the internet should be treated as compromised. A reboot may clear a memory-resident bot, but the hole remains and the device can be reinfected.
Timeline#
- — DIR-820L reaches end of service (per D-Link).
- — Researcher publicly discloses the ping.ccp injection.
- — CVE-2023-25280 published.
- — Unit 42 first sees the exploit in a Mirai campaign.
- — Unit 42 publishes its campaign analysis.
- — CISA adds the CVE to KEV; federal deadline Oct 21, 2024 is to stop using the device.
Vulnerability records
- CVE-2023-25280 · KEV 2024-09-30 · OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- D-Link — SAP10358: Information regarding Malware Botnet IZ1H9 (EOL/EOS models incl. DIR-820L) supportannouncement.us.dlink.com
- CVE record — CVE-2023-25280 cve.org
- NVD — CVE-2023-25280 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2023-25280 cisa.gov
- CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 30, 2024) cisa.gov
- migraine-sudo (researcher) — D-Link DIR820LA1 command injection in pingV4Msg github.com
- Palo Alto Networks Unit 42 — IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits unit42.paloaltonetworks.com