LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25368: A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firm...

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-25368 affects D-Link DIR-823G routers running firmware V1.0.2B05. The reported flaw is command injection through the HNAP1 Login PrivateLogin field. A successful attacker could make the device run unintended commands. No public source provided here confirms active exploitation or a vendor patch for this specific CVE.

Executive priority

Treat this as a high-priority router exposure review if DIR-823G devices are in use. Prioritize internet-facing or broadly reachable management interfaces. Business urgency depends on whether affected firmware exists in your environment and whether vendor-supported remediation is available.

Technical view

The CVE record describes command injection in the HNAP1 protocol on D-Link DIR-823G firmware V1.0.2B05. Shell metacharacters in the Login PrivateLogin field can lead to arbitrary execution. Severity, CVSS, CWE, and precise authentication requirements are not provided in the bundled CVE data.

Likely exposure

Exposure is limited to organizations using D-Link DIR-823G devices with firmware V1.0.2B05. Risk increases if the router management or HNAP1 interface is reachable from untrusted networks. The supplied data does not identify other models or firmware versions as affected.

Exploitation context

The bundled references include a public researcher write-up and D-Link security bulletin page. CISA KEV status is false, and no cited source here confirms active exploitation in the wild. Public technical detail may still enable defenders and attackers to recognize the vulnerable input path.

Researcher notes

Evidence is thin: the CVE lacks CVSS, CWE, detailed affected CPEs, and explicit fix data. Avoid assuming broader D-Link impact. Validate against DIR-823G firmware V1.0.2B05 and the cited researcher reference, but do not rely on this bundle to establish exploit prevalence.

Mitigation direction

  • Identify any D-Link DIR-823G routers running firmware V1.0.2B05.
  • Check D-Link’s security bulletin and support channels for model-specific firmware guidance.
  • Restrict router management and HNAP access to trusted administrative networks only.
  • Replace or isolate devices if no supported vendor fix is available.
  • Monitor for unexpected configuration changes or suspicious administrative access.

Validation and detection

  • Inventory DIR-823G devices and record firmware versions.
  • Verify whether HNAP1 or web administration is reachable from untrusted networks.
  • Review D-Link advisories for a DIR-823G firmware update or mitigation.
  • Check device logs for unusual Login activity where available.
  • Confirm compensating access controls are enforced on management interfaces.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25368 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.