EUVD-2026-13800Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a high real-world risk. The CVSS score of 7.3 reflects network-based attack vector (AV:N), low attack complexity (AC:L), and no authentication required (PR:N), making it easily exploitable. The SSVC framework confirms exploitation with a public proof-of-concept and marks it as automatable with partial technical impact, meaning attackers can script exploitation at scale. The availability of a detailed POC exploit on GitHub significantly lowers the barrier to entry for attackers. While EPSS data is not explicitly provided, the combination of remote exploitation, no authentication requirement, public exploit code, and the prevalence of vulnerable IoT devices in production environments makes this a priority for immediate remediation. This is not merely a theoretical high-CVSS issue but a practically exploitable vulnerability affecting internet-facing devices. |
| Exploit ScenarioDerived | An attacker on the internet scans for D-Link DIR-820LW routers with UPnP/SSDP enabled and exposed. Using the publicly available exploit code, the attacker crafts a malicious SSDP discovery request with injected shell commands in the HTTP_ST parameter, such as downloading and executing a botnet client or establishing a reverse shell. The router executes these commands with system privileges, allowing the attacker to gain full control of the device, pivot to internal networks, or incorporate the router into a botnet for DDoS attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
An OS command injection vulnerability exists in the D-Link DIR-820LW router firmware version 2.03, specifically in the ssdpcgi_main function of the SSDP component. The vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands via manipulation of the HTTP_ST environment variable. A proof-of-concept exploit has been publicly disclosed on GitHub, making this an immediate concern for organizations using affected devices.
RemediationAI
Users should immediately check the D-Link support website at https://www.dlink.com/ for firmware updates addressing this vulnerability in the DIR-820LW router. If no patch is available and the device is end-of-life, organizations should consider replacing the affected hardware with supported models. As interim mitigations, disable SSDP/UPnP functionality if not required for business operations, restrict network access to the router's management interface to trusted IP addresses only, and place affected devices behind a firewall that blocks external access to UPnP services (typically UDP port 1900 and related TCP ports). Given the age of the firmware version (2.03) and D-Link's history of discontinuing support for older consumer routers, device replacement may be the most viable long-term solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Simple Service Discovery Protocol (SSDP) implementation of the D-Link DIR-820LW router, specifically within the ssdpcgi_main function. SSDP is part of UPnP (Universal Plug and Play) and is used for network device discovery. The affected product is identified by CPE cpe:2.3:a:d-link:dir-820lw:*:*:*:*:*:*:*:*. This is classified as CWE-78 (OS Command Injection), meaning the application constructs operating system commands using externally-influenced input without properly neutralizing special elements. The HTTP_ST environment variable, which should be treated as untrusted user input, is improperly handled and allows injection of shell metacharacters that are then executed by the underlying system with the privileges of the web server process.
Know when Dir 820Lw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
D-Link DIR-820LW routers are vulnerable to remote command injection attacks without authentication or patch availability, potentially allowing attackers to gain complete control of affected network infrastructure. Organizations using this router model face immediate risk of network compromise, data exfiltration, and lateral movement into corporate systems, particularly concerning for branch offices and remote locations.
Disable SSDP service if not operationally required; restrict network access to router management interfaces using firewall rules; implement Web Application Firewall rules to filter malicious HTTP_ST header patterns; segment router access to dedicated management VLANs; monitor for suspicious command execution patterns on affected devices; consider implementing IDS/IPS signatures for known exploit traffic patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB