CVE-2022-26258

What it actually does

This is an unauthenticated network-reachable command injection vulnerability in the D-Link DIR-820L web management interface, reported in firmware version 1.05B03. A crafted HTTP POST request to the get_set.ccp handler can cause attacker-controlled input to be interpreted by the underlying operating system shell, allowing arbitrary command execution with the privileges of the router web service, commonly root or an equivalent highly privileged embedded-system account. Successful exploitation can compromise confidentiality, integrity, and availability by enabling configuration theft, DNS or routing changes, malware installation, traffic interception, device bricking, or pivoting from the router into adjacent networks. Note: the supplied package metadata references jhy/jsoup and commit c5964172763e1495786ad584c368ac3346d0ca8c, which does not align with the D-Link router vulnerability description; asset owners should validate whether dependency metadata has been incorrectly associated with this CVE.

Why it matters to the business

Compromise of an edge router can disrupt internet connectivity, expose internal traffic, redirect users to malicious destinations, and provide attackers with a persistent foothold at the network perimeter. Because this issue is listed in CISA KEV, has a high EPSS score of 0.79813, and is marked as actively exploited in the wild, internet-exposed devices should be treated as high-risk even though the original CISA remediation deadline of 2022-09-29 has long passed. Organizations relying on affected or end-of-life D-Link DIR-820L devices face increased operational risk because consumer/SOHO routers are often poorly logged, rarely monitored, and commonly targeted by botnets.

How an attack unfolds

An attacker first identifies a reachable D-Link DIR-820L management interface, typically by scanning for exposed HTTP services and fingerprinting router-specific pages, headers, or URLs. The attacker then sends a crafted unauthenticated HTTP POST request to the get_set.ccp endpoint with shell metacharacters or command payloads embedded in a vulnerable parameter. If the firmware passes that input to a system command without proper sanitization, the router executes the injected command. Initial commands commonly verify execution using ping, wget, curl, tftp, nslookup, or busybox, followed by downloading malware or scripts into writable directories such as /tmp or /var/tmp. After gaining command execution, the attacker may change DNS settings, add firewall or NAT rules, harvest configuration data, install botnet malware, open a reverse shell, proxy traffic, or use the router as a staging point for attacks against internal systems.

How to fix it

Remove affected D-Link DIR-820L firmware version 1.05B03 from service or upgrade to a vendor-provided fixed firmware if available. If no supported fixed firmware exists, replace the device with a currently supported router because perimeter devices with known exploited RCE vulnerabilities are not safe to operate on untrusted networks. Disable WAN-side administration, UPnP, remote management, and any unnecessary services; restrict management access to a dedicated trusted management network; and block inbound access to router administrative ports from the internet. Rotate router administrator credentials, export and review configuration for unauthorized DNS, NAT, port-forwarding, VPN, or firewall changes, and factory-reset/reconfigure devices that may have been exposed. The provided fixed-version metadata lists jhy/jsoup fixed at commit c5964172763e1495786ad584c368ac3346d0ca8c; because this does not match the D-Link router vulnerability, separately verify software composition records and update any actual jhy/jsoup Git dependency to that commit or later if it is independently present.

How to confirm the fix worked

Confirm whether any D-Link DIR-820L devices are present, especially firmware 1.05B03, using asset inventory, network scans, router administration pages, configuration backups, DHCP records, and external attack-surface monitoring. Validate that the router management interface is not reachable from the internet and that only trusted administrative sources can reach it internally. Attempt only authorized testing: request /get_set.ccp and confirm the endpoint is inaccessible externally or the device is no longer running affected firmware. After remediation, verify firmware version, confirm remote management is disabled, review DNS and firewall/NAT settings, and rescan exposed address space. If using dependency scanners, investigate any jhy/jsoup finding tied to this record because the package metadata appears inconsistent with the router-specific CVE description.

Typical attack path

1. Scan the internet or a target address range for exposed D-Link DIR-820L web management services.
2. Fingerprint the device model and firmware using web paths, login pages, headers, page content, or UPnP/banner information.
3. Send a crafted HTTP POST request to /get_set.ccp or get_set.ccp containing command injection syntax.
4. Use a simple command such as ping, nslookup, wget, curl, tftp, or busybox to confirm code execution.
5. Download and execute a payload from an attacker-controlled host, usually into /tmp or /var/tmp.
6. Modify router configuration, install persistence where possible, join a botnet, redirect DNS/traffic, or proxy further attacks.
7. Optionally pivot toward internal network services reachable from the compromised router.

How to detect it

Review perimeter firewall, reverse proxy, IDS/IPS, NetFlow, DNS, and router administrative logs for access to /get_set.ccp or get_set.ccp, especially HTTP POST requests containing shell metacharacters, command names, or download utilities. Look for outbound connections from the router to unusual external IPs or domains after administrative HTTP requests, particularly HTTP, HTTPS, TFTP, FTP, Telnet, SSH, IRC, or high-numbered ports. Inspect DNS logs for lookups generated by the router immediately after suspicious requests, which may indicate command-execution testing. If device shell access or forensic acquisition is possible, examine volatile directories such as /tmp and /var/tmp for downloaded binaries or scripts, inspect running processes for wget/curl/tftp/busybox/sh payload chains, and review startup/configuration files for unauthorized persistence. Also compare router configuration backups against known-good baselines for altered DNS resolvers, port forwards, firewall rules, VPN settings, proxy settings, or unknown administrative users. Because many consumer routers have limited logging, absence of local logs should not be considered proof of no exploitation; rely on upstream network telemetry where available.

• POST /get_set.ccp
• POST /get_set.ccp HTTP/1.1
• get_set.ccp
• /get_set.ccp
• get_set.ccp;
• get_set.ccp%3B
• get_set.ccp|
• get_set.ccp%7C
• get_set.ccp`
• get_set.ccp%60
• get_set.ccp$(
• get_set.ccp%24%28
• get_set.ccp&&
• get_set.ccp%26%26
• wget http
• curl http
• tftp -g
• busybox wget
• /tmp/
• /var/tmp/
• chmod +x /tmp
• chmod 777 /tmp
• /bin/sh -c
• sh -c wget
• sh -c curl
• sh -c tftp
• POST /get_set.ccp HTTP/1.1" 200
• POST /get_set.ccp HTTP/1.1" 500

What your security team should do

• Immediately identify and remove or isolate internet-exposed D-Link DIR-820L devices, prioritizing firmware 1.05B03.
• Treat exposed affected devices as potentially compromised because the vulnerability is in CISA KEV and exploitation is active in the wild.
• Disable WAN-side router administration and restrict all management interfaces to trusted administrative networks.
• Replace unsupported devices or apply a vendor-confirmed fixed firmware; do not rely solely on firewall rules for long-term risk reduction.
• Review router configurations for unauthorized DNS servers, port forwards, VPN users, firewall rules, startup scripts, or unknown administrative accounts.
• Collect available logs and network telemetry before factory reset or replacement when compromise is suspected.
• Rotate credentials and shared secrets that may have traversed or been stored on affected routers.
• Add SIEM and network detection for POST requests to /get_set.ccp and shell-command patterns in HTTP request bodies.
• Verify the apparent metadata mismatch involving jhy/jsoup fixed commit c5964172763e1495786ad584c368ac3346d0ca8c before opening application remediation work under this CVE.