CVE-2013-5223 in DSL-2760U
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/22/2026
The CVE-2013-5223 vulnerability represents a significant cross-site scripting flaw affecting D-Link DSL-2760U Gateway version E1, classified under CWE-79 as improper neutralization of input during web page generation. This vulnerability stems from insufficient sanitization of user-supplied input parameters within multiple CGI scripts that handle configuration management for network devices. The flaw allows authenticated remote attackers to inject malicious web scripts or HTML content, potentially compromising the integrity of the device's web interface and enabling further exploitation of the network infrastructure.
The technical implementation of this vulnerability spans across sixteen distinct parameter injection points within various configuration management scripts, each representing a separate attack vector. The affected parameters include ntpServer1 in sntpcfg.cgi, username in ddnsmngr.cmd, TodUrlAdd in urlfilter.cmd, and numerous others including fltName in scoutflt.cmd, groupName in portmapcfg.cmd, and wlSsid in wlcfg.wl. These parameters are processed without adequate input validation or output encoding, creating persistent XSS opportunities that can be exploited by authenticated users with access to the device's web management interface.
The operational impact of CVE-2013-5223 extends beyond simple script injection, as it provides attackers with the capability to manipulate the device's configuration interface and potentially escalate privileges. Attackers could craft malicious payloads that persist across sessions, allowing them to redirect users to phishing sites, steal session cookies, or modify network configurations. The vulnerability affects critical network infrastructure components including NTP configuration, URL filtering, port mapping, SNMP settings, and wireless network parameters, making it particularly dangerous for enterprise environments where these devices serve as primary network gateways.
Security practitioners should implement comprehensive mitigation strategies including input validation, output encoding, and regular firmware updates to address this vulnerability. The ATT&CK framework categorizes this as a web application vulnerability exploitation technique, specifically related to credential access and privilege escalation. Organizations should also consider network segmentation, regular security assessments, and monitoring for suspicious configuration changes. Given the authenticated nature of the attack, implementing strong access controls and regular credential rotation provides additional defense layers against exploitation attempts. The vulnerability demonstrates the critical importance of input sanitization in embedded network devices and highlights the need for robust security practices in IoT and network infrastructure equipment.