---
id: "CVE-2013-5223"
kind: "vulnerability"
aliases: ["CVE-2013-5223"]
title: "D-Link DSL-2760U: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability"
severity: "medium"
cvss: 5.4
epss: 0.50833
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link DSL-2760U", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "dsl-2760u", "exploited", "home-router", "infrastructure"]
not_affected_if: ["other-vendor-hardware"]
published_at: "2013-11-19T04:50:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-5223", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-5223", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5223", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# D-Link DSL-2760U: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

The D-Link DSL-2760U home gateway's web interface does not sanitize input, so a logged-in user can inject script or HTML. An attacker who gets a victim to load the injected page can run script in that browser session, and the CISA KEV listing says it is being exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link DSL-2760U affected ? fixed ?

## Fix

Apply the vendor update per D-Link instructions (CISA required action); no fixed version is given in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-5223
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-5223
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-5223

## From the sources

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_