AEGLIX vulnerability intelligence
CVE-2013-5223
MEDIUM · CVSS 5.4 · Analyzed
Published: 2013-11-19 · Updated: 2026-06-16 · Source: NVD
Vulnerability overview
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
Severity and scoring
- CVSS score
- 5.4 · MEDIUM
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- D-Link · DSL-2760U
- Added to catalog
- 2022-03-25
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-04-15
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:o:dlink:dsl-2760u_firmware:*:*:*:*:*:*:*:*
Before (exclusive): 1.12
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://osvdb.org/99603
Broken Link
- http://osvdb.org/99604
Broken Link
- http://osvdb.org/99605
Broken Link
- http://osvdb.org/99606
Broken Link
- http://osvdb.org/99607
Broken Link
- http://osvdb.org/99608
Broken Link
- http://osvdb.org/99609
Broken Link
- http://osvdb.org/99610
Broken Link
- http://osvdb.org/99611
Broken Link
- http://osvdb.org/99612
Broken Link
- http://osvdb.org/99613
Broken Link
- http://osvdb.org/99615
Broken Link
- http://osvdb.org/99616
Broken Link
- http://packetstormsecurity.com/files/123976
Exploit · Third Party Advisory · VDB Entry
- http://seclists.org/fulldisclosure/2013/Nov/76
Exploit · Mailing List · Third Party Advisory
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002
Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88723
Third Party Advisory · VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88724
Third Party Advisory · VDB Entry
- http://osvdb.org/99603
Broken Link
- http://osvdb.org/99604
Broken Link
- http://osvdb.org/99605
Broken Link
- http://osvdb.org/99606
Broken Link
- http://osvdb.org/99607
Broken Link
- http://osvdb.org/99608
Broken Link
- http://osvdb.org/99609
Broken Link
- http://osvdb.org/99610
Broken Link
- http://osvdb.org/99611
Broken Link
- http://osvdb.org/99612
Broken Link
- http://osvdb.org/99613
Broken Link
- http://osvdb.org/99615
Broken Link
- http://osvdb.org/99616
Broken Link
- http://packetstormsecurity.com/files/123976
Exploit · Third Party Advisory · VDB Entry
- http://seclists.org/fulldisclosure/2013/Nov/76
Exploit · Mailing List · Third Party Advisory
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002
Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88723
Third Party Advisory · VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88724
Third Party Advisory · VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5223
US Government Resource