{"id":"CVE-2013-5223","kind":"vulnerability","aliases":["CVE-2013-5223"],"related":[],"title":"D-Link DSL-2760U: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.","summary":"The D-Link DSL-2760U home gateway's web interface does not sanitize input, so a logged-in user can inject script or HTML. An attacker who gets a victim to load the injected page can run script in that browser session, and the CISA KEV listing says it is being exploited in the wild.","severity":"medium","cvss":5.4,"epss":0.50833,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"D-Link DSL-2760U","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dsl-2760u","exploited","home-router","infrastructure"],"not_affected_if":["other-vendor-hardware"],"how_to_check":null,"fix":"Apply the vendor update per D-Link instructions (CISA required action); no fixed version is given in the sources.","status":"open","published_at":"2013-11-19T04:50:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:22:08Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per D-Link instructions (CISA required action); no fixed version is given in the sources.\nunknown","reach":"network","impact":"medium","summary":"The D-Link DSL-2760U home gateway's web interface does not sanitize input, so a logged-in user can inject script or HTML. An attacker who gets a victim to load the injected page can run script in that browser session, and the CISA KEV listing says it is being exploited in the wild.","category":"infrastructure","who_cares":["d-link","dsl-2760u","home-router"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs script in admin browser session on the gateway","analyst_note":"Find the D-Link advisory and fixed firmware version for DSL-2760U; check CISA KEV entry for exploitation details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-vendor-hardware"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000467,"input_tokens":2855,"output_tokens":363,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':20A,23A '-5223':21A,24A '1':130C '10':179C '11':184C '12':191C '13':200C '14':205C '15':208C '16':214C '2':138C '2760u':6A,12A,30A,36B,48B,113C '3':141C '4':143C '5':148C '6':153C '7':160C '8':169C '9':174C 'action':158C,166C,189C,197C 'add':157C,188C 'allow':117C 'appnam':149C 'arbitrari':123C 'attack':70B 'authent':119C 'browser':85B 'cisa':89B 'cross':15A,102C 'cross-sit':14A,101C 'cve':19A,22A 'd':2A,8A,26A,32B,44B,109C 'd-link':1A,7A,25A,31B,43B,108C 'ddnsmngr.cmd':139C 'dsl':5A,11A,29A,35B,47B,112C 'dsl-2760u':4A,10A,28A,34B,46B,111C 'e1':116C 'exploit':37B,96B 'fltname':154C,180C 'gateway':13A,50B,114C 'get':72B 'groupnam':170C 'home':39B,49B 'home-rout':38B 'html':68B,127C 'infrastructur':41B 'inject':65B,78B,122C 'input':57B 'interfac':53B 'ippcfg.cmd':204C 'ippnam':201C 'kev':90B 'link':3A,9A,27A,33B,45B,110C 'list':91B 'load':76B 'log':61B 'logged-in':60B 'multipl':100C 'ntpserver1':131C 'page':79B 'paramet':132C,136C,145C,150C,162C,171C,176C,181C,193C,202C,210C,216C 'policynam':185C 'portmapcfg.cmd':173C 'prmngr.cmd':199C 'remot':118C 'remov':165C,196C 'rev':115C 'rmlst':161C,192C 'router':40B 'run':81B 'samba.cgi':212C 'sanit':56B 'say':92B 'scinflt.cmd':183C 'scoutflt.cmd':168C 'scprttrg.cmd':152C 'script':17A,66B,82B,104C,125C 'session':86B 'site':16A,103C 'smbdirnam':209C 'smbnetbiosnam':206C 'snmpconfig.cgi':178C 'snmprocommun':175C 'sntpcfg.cgi':134C 'todmngr.tod':142C 'todurladd':144C 'urlfilter.cmd':147C 'user':63B,120C 'usernam':135C 'via':128C 'victim':74B 'vulner':18A,106C 'web':52B,124C 'wild':99B 'wlcfg.wl':218C 'wlssid':215C 'xss':105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-11-19T04:50:12+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-5223","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-5223","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2013-5223","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-5223","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-5223","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5223","severity":null,"published_at":"2013-11-19T04:50:12+00:00","modified_at":"2026-06-16T23:58:32+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}