CVE-2022-26258
KEVD-Link DIR-820L Remote Code Execution Vulnerability
Description
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedMar 28, 2022
Last modifiedJul 9, 2026
Added to KEVSep 8, 2022
Remediation dueSep 29, 2022
References
- github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0Broken LinkExploit
- github.com/zhizhuoshuma/cve_info_data/blob/ccaed4b94ba762eb8a8e003bfa762a7754b8182e/Vuln/Vuln/DIR-820L/command_execution_0/README.mdExploitThird Party Advisory
- dlink.com/en/security-bulletin/Not ApplicableVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26258US Government Resource
0 recent articles mention this CVE
88
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1489 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 91.6% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.