Secuno
ENNL
Book demo

CVE-2013-5223

D-Link DSL-2760U Gateway Cross-Site Scripting

5.4 MEDIUMActively exploited (CISA KEV)Public exploitEPSS 50.8%
  1. Published19 Nov 2013
  2. Added to CISA KEV25 Mar 2022
  3. Remediation due15 Apr 2022
Actively exploited (CISA KEV)

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

Added to KEV: 25 Mar 2022Federal remediation due: 15 Apr 2022

Description

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

D-Link Dsl-2760u Firmware< 1.12

Remediation

Fixed in
D-Link Dsl-2760u Firmware≥ 1.12

References

and 9 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1095588.7
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in…
CVE-2026-1095578.7
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in…
CVE-2026-1054108.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition…
CVE-2026-1054098.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition…
CVE-2026-1054088.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition…
CVE-2026-962278.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a…

Frequently asked

Is CVE-2013-5223 being actively exploited?

Yes. CVE-2013-5223 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022.

How severe is CVE-2013-5223?

CVE-2013-5223 has a CVSS 3.1 base score of 5.4, rated medium. EPSS estimates a 50.8% probability of exploitation.

Which products are affected by CVE-2013-5223?

Affected products include D-Link Dsl-2760u Firmware.

How do I fix CVE-2013-5223?

Upgrade affected software to a fixed version, for example D-Link Dsl-2760u Firmware 1.12 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2013-5223 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.