CVE-2013-5223
Summary
| CVE | CVE-2013-5223 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-11-19 04:50:12 UTC |
| Updated | 2026-04-22 13:44:22 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl. |
Risk And Classification
Primary CVSS: v3.1 5.4 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.300760000 probability, percentile 0.966770000 (date 2026-04-24)
CISA KEV: Listed on 2022-03-25; due 2022-04-15; ransomware use Unknown
Problem Types: CWE-79 | n/a | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | ADP | DECLARED | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| 2.0 | [email protected] | Primary | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:S/C:N/I:P/A:N
CISA Known Exploited Vulnerability
| Vendor | D-Link |
|---|---|
| Product | DSL-2760U |
| Name | D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2013-5223 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Dlink | Dsl-2760u | e1 | All | All | All |
| Operating System | Dlink | Dsl-2760u Firmware | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| D-Link Router 2760N Cross Site Scripting ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | Exploit, Third Party Advisory, VDB Entry |
| osvdb.org/99603 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99604 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99605 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99606 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | Third Party Advisory, VDB Entry |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | Third Party Advisory, VDB Entry |
| osvdb.org/99607 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| Full Disclosure: D-Link Router 2760N (DSL-2760U-BN) Multiple XSS | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Exploit, Mailing List, Third Party Advisory |
| osvdb.org/99609 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99608 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99615 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99616 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99610 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99611 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99612 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| osvdb.org/99613 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| D-Link Technical Support | af854a3a-2127-422b-91ae-364da2661108 | securityadvisories.dlink.com | Vendor Advisory |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2022-03-25T00:00:00.000Z | CVE-2013-5223 added to CISA KEV |
Legacy QID Mappings
- 379468 For Vulnerability CVE-2013-5223