ZeroDay Findings
Sign inSign up

Findings

CVE-2013-5223

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

Published Nov 18, 2013 · updated Jun 16, 2026 · dlink dsl-2760u firmware

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 18, 2013 · Catalog

    Detected

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst paramet

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst paramet

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe dlink/dsl-2760u firmwareversion unspecified
  • vendor D-Link DSL-2760Uversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2013-5223

    A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2013-5223

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2013-5223

    30-day exploitation probability 50.8%

    first.org
  • Exploit DatabasePublic exploit reference36987

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference36988

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDVulnerability recordCVE-2013-5223

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrl

    nvd.nist.gov

References