D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

published 2022-03-27 4y ago modified 2026-07-09 4mo ago also EUVD-2022-30821

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-09-08
epss: 91.6%; EPSS 91.6% chance of exploitation in 30 days, percentile 99.8%
public exploits: 0; none known

Patch / fix

cisa required action The impacted product is end-of-life and should be disconnected if still in use.

Is CVE-2022-26258 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2022-03-27 Published
2022-09-08 Added to CISA KEV
2022-09-29 CISA patch deadline
2025-01-29 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-09-08)
Patch by: 2022-09-29 (4y ago)
Ransomware: Not known
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Vendor, product: D-Link, DIR-820L
CISA name: D-Link DIR-820L Remote Code Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1059 Command and Scripting Interpreter primary impact
T1499.002 Service Exhaustion Flood secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-01-29)

Exploit prediction

91.63% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/zhizhuoshuma/cve_info_data/blob/ccaed4b94ba762eb8a8e003bfa762a7754b8182e/Vuln/Vuln/DIR-820L/command_execution_0/README.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

github.com /skyedai910/Vuln/tree/master/DIR-820L/command_execution_0
broken-link, exploit, third-party-advisory
github.com /zhizhuoshuma/cve_info_data/blob/ccaed4b94ba762eb8a8e003bfa762a7754b8182e/Vuln/Vuln/DIR-820L/command_execution
exploit, third-party-advisory
dlink.com /en/security-bulletin/
not-applicable, vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26258
government-resource, us-government-resource

Sources

CVE List CVE-2022-26258
NVD CVE-2022-26258

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed