---
title: "D-Link DIR-820L CVE-2023-25280: Unpatchable Router RCE"
url: https://erroneo.us/security/briefs/d-link-dir-820-cve-2023-25280-ping-command-injection/
description: "Root command injection in end-of-life D-Link DIR-820L routers, used by Mirai botnets and in CISA KEV. No patch exists or will exist; replace the device."
type: security-brief
section: "Security Digest"
date_published: 2023-03-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-25280"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# D-Link DIR-820L CVE-2023-25280: Unpatchable Router RCE

**Verdict: Check exposure.** There is no patch and never will be: if a DIR-820L is still on any network you are responsible for, replace it now; if you have none, there is nothing to do.

- **Who must act:** Anyone with a D-Link DIR-820L (DIR-820) router still in service, including small branch offices, home offices of remote staff and forgotten lab or guest networks.
- **Who can relax:** Organizations with no DIR-820L hardware anywhere in their estate; no other D-Link product is covered by this CVE.
- **Affected:** D-Link DIR-820L (rev A1) firmware 1.05B03 (DIR820LA1_FW105B03); All DIR-820L hardware revisions are end-of-service since Nov 1, 2017 and receive no fixes
- **Fixed:** None. D-Link will not release a fix; replace the router.
- **CVEs:** CVE-2023-25280
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory routers at branch, home-office, lab and guest sites and look for the DIR-820L model on the device label or admin page.
2. Replace every DIR-820L with a supported router; there is no firmware fix.
3. Until it is replaced, disable remote (WAN-side) management and restrict the admin page to a wired management host.
4. Change the router admin and Wi-Fi passwords, and assume credentials stored on it were exposed.
5. After replacement, scan the network segment behind it for other end-of-life devices.

### How to check if you are affected

- Search web proxy, IDS or upstream logs for POST requests to /ping.ccp with ccp_act=pingV4Msg and a ping_addr value containing %0a, wget or curl.
- Check for outbound connections to the Unit 42 indicators zvub[.]us, 185.225.74[.]251, 185.44.81[.]114 and 193.32.162[.]189.
- Look for unexplained outbound traffic bursts or telnet scanning from the router's WAN address, typical of a Mirai bot.
- Treat any DIR-820L that was reachable from the internet as compromised; a reboot may clear the bot but not the hole.

## What happened

[CVE-2023-25280](https://www.cve.org/CVERecord?id=CVE-2023-25280) is an OS command injection flaw in the D-Link DIR-820L router (firmware DIR820LA1_FW105B03). The router's `/ping.ccp` handler passes the `ping_addr` parameter into a shell command. Its input filter does not block newline characters (`%0a`) or `$`, so one crafted POST runs commands as root. A [researcher's write-up](https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg) was published in February 2023, and the CVE record followed on March 16, 2023. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-25280) scores it CVSS 3.1 9.8. CISA describes it as exploitable by a remote, unauthenticated attacker.

Exploitation started quickly. [Palo Alto Networks Unit 42](https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/) reported in June 2023 on a Mirai variant campaign that targeted about two dozen IoT flaws. It first saw this CVE in that traffic on April 11, 2023. Infected devices download an architecture-specific bot and are used for DDoS attacks.

## Who is affected

Only DIR-820L routers. In its [SAP10358 notice](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358), D-Link lists the DIR-820L as end-of-service since November 1, 2017, for all regions and hardware revisions, with "Not Available" under fixed firmware. That notice was written for an earlier Mirai variant (IZ1H9) that used two older DIR-820L bugs, CVE-2015-1187 and CVE-2021-45382. CISA's KEV catalog also lists a third DIR-820L RCE, CVE-2022-26258. On this hardware, CVE-2023-25280 is one more way in among several.

## Do you really need to act?

Only if you still have one, and then the answer is yes. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280) on September 30, 2024, 18 months after Unit 42's report. The [CISA alert](https://www.cisa.gov/news-events/alerts/2024/09/30/cisa-adds-four-known-exploited-vulnerabilities-catalog) cites only "evidence of active exploitation." It does not name the campaign or the reporter that prompted the 2024 listing, and we found no public report explaining the timing. The required action is not a patch: "The impacted product is end-of-life... Users should discontinue utilization of the product."

The realistic exposure is small offices, remote workers' homes and forgotten guest or lab networks. Botnets scan the whole internet, so obscurity does not help. A compromised router can also see and redirect the traffic of everything behind it.

## What to do now

1. Find any DIR-820L. Check device labels and the admin page's model and firmware fields at branch, home-office and lab sites. Sweep subnets for admin web interfaces, for example `nmap -p 80,443,8080 --open 192.168.0.0/24`, and open each one you don't recognize.
2. Replace it with a supported router. Reflashing the last firmware or a factory reset does not remove the bug, and D-Link does not support third-party firmware. D-Link offers US owners a discounted replacement in SAP10358.
3. Until the swap, turn off remote (WAN-side) management, restrict the admin page to a single wired host, and set strong, unique admin and Wi-Fi passwords.
4. After replacement, rotate any credentials that were configured on or passed through the old router, such as PPPoE, VPN and Wi-Fi keys.

## How to tell if you were hit

The Mirai variant Unit 42 analyzed deletes its downloaded file after it runs, so look at the network. Search upstream proxy or IDS logs for POSTs to `/ping.ccp` with `ccp_act=pingV4Msg` and a `ping_addr` containing `%0a`, `wget` or `curl`. Check for connections to the Unit 42 indicators `zvub[.]us`, `185.225.74[.]251`, `185.44.81[.]114` and `193.32.162[.]189`. Watch for unexplained outbound floods or telnet scanning from the router's WAN address. Any DIR-820L that was reachable from the internet should be treated as compromised. A reboot may clear a memory-resident bot, but the hole remains and the device can be reinfected.

## Timeline

- Nov 1, 2017 — DIR-820L reaches end of service (per D-Link).
- Feb 7, 2023 — Researcher publicly discloses the ping.ccp injection.
- Mar 16, 2023 — CVE-2023-25280 published.
- Apr 11, 2023 — Unit 42 first sees the exploit in a Mirai campaign.
- Jun 22, 2023 — Unit 42 publishes its campaign analysis.
- Sep 30, 2024 — CISA adds the CVE to KEV; federal deadline Oct 21, 2024 is to stop using the device.

## Sources

1. [D-Link — SAP10358: Information regarding Malware Botnet IZ1H9 (EOL/EOS models incl. DIR-820L)](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358)
2. [CVE record — CVE-2023-25280](https://www.cve.org/CVERecord?id=CVE-2023-25280)
3. [NVD — CVE-2023-25280](https://nvd.nist.gov/vuln/detail/CVE-2023-25280)
4. [CISA — Known Exploited Vulnerabilities: CVE-2023-25280](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280)
5. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 30, 2024)](https://www.cisa.gov/news-events/alerts/2024/09/30/cisa-adds-four-known-exploited-vulnerabilities-catalog)
6. [migraine-sudo (researcher) — D-Link DIR820LA1 command injection in pingV4Msg](https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg)
7. [Palo Alto Networks Unit 42 — IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits](https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/)
8. [Security Affairs — CISA adds D-Link DIR-820 Router, DrayTek, SAP Commerce Cloud bugs to KEV](https://securityaffairs.com/?p=169189)

---
Source page: https://erroneo.us/security/briefs/d-link-dir-820-cve-2023-25280-ping-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt