What is the CVSS score of CVE-2026-52533?

CVE-2026-52533 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of D-Link DIR-1253 are affected by CVE-2026-52533?

The D-Link DIR-1253 router (v1.0.1.250923.142435) contains a critical privilege escalation vulnerability (CVSS 9.8) with publicly available exploit code, enabling unauthenticated attackers to gain…

How to fix or mitigate CVE-2026-52533?

Within 24 hours: identify and isolate all affected DIR-1253 devices from production; disable remote management interfaces (WAN-accessible web console, UPnP); document inventory and asset criticality. Within 7 days: contact D-Link support to confirm patch timeline and device support status; initiate replacement procurement with current-generation firmware from D-Link or alternative vendors. Within 30 days: execute hardware replacement of all affected units, implement network segmentation to isolate any remaining legacy devices, and conduct vulnerability re-scan to confirm remediation.

D-Link DIR-1253 CVE-2026-52533

EUVD-2026-43609 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-13 mitre

GHSA-fqgf-jr4j-gw4g

Privilege Escalation D-Link N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Abuse of a local /etc/shadow file realistically needs a device/adjacent foothold (AV:A) and some existing access (PR:L) to escalate; root then gives full C/I/A impact.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 14:26 vuln.today

CVSS changed

Jul 14, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 13, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file

AnalysisAI

Privilege escalation in D-Link DIR-1253 firmware v1.0.1.250923.142435 stems from improper handling of the /etc/shadow file - the store of hashed local credentials - letting an attacker obtain or elevate to root-level access on the device. Publicly available exploit code exists (referenced via the zuh.re/codeberg advisory), but there is no public exploit identified as actively exploited and the CVE is not on the CISA KEV list. The published CVSS of 9.8 (AV:N) appears optimistic given that the core issue centers on a local system credential file, so the true remote-unauthenticated reach should be verified against the vendor advisory.

Technical ContextAI

The DIR-1253 is a D-Link consumer/SOHO Wi-Fi router running embedded Linux-based firmware. On such systems /etc/shadow holds the salted password hashes for local accounts including root and is meant to be readable and writable only by root. The flaw is classified as CWE-269 (Improper Privilege Management), meaning the firmware either exposes, mis-permissions, or otherwise fails to protect this credential store, allowing a lower-privileged context to read hashes (enabling offline cracking) or write/replace them (directly gaining root). The MITRE-supplied CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) providing no usable product identification, so affected-product scope rests entirely on the description text.

RemediationAI

No vendor-released patch version is identified at time of analysis, so monitor the D-Link security bulletin page (https://www.dlink.com/en/security-bulletin/) and apply fixed DIR-1253 firmware as soon as D-Link publishes it. Until a patched build is confirmed, reduce exposure with concrete compensating controls: disable remote/WAN management on the router (trade-off: administrators lose off-LAN configuration access), restrict administrative access to a trusted management VLAN or specific LAN hosts, block inbound access to the router's HTTP/HTTPS/Telnet/SSH management ports from the internet at the perimeter, and change all device credentials to strong unique values (trade-off: does not fix the underlying file-permission flaw but limits reuse if hashes are exposed). Review the referenced PoC/advisory (https://zuh.re/cve/2026-52533/ and https://codeberg.org/zuhri/advisory#recent-poc) to identify the exact triggering interface so the corresponding service can be firewalled off.