External risk intelligence

D-Link DIR-823G Firmware Upload Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2020-25366

The vulnerability resides in a firmware upload function of a D-Link router. Such administrative interfaces, while intended for local network management, are frequently exposed to the internet in home and small office deployments, making them commonly reachable edge services.

Denial of Service

Dlink Dir 823g Firmware

1.02b05

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects D-Link routers, specifically their firmware upload component. While the exact impact is unconfirmed, it could potentially allow for unauthorized access to modify device behavior or disrupt services. The main concern at this stage is to confirm if these devices are in use and if they are exposed to potential threats.

Firmware upload flaw in D-Link routers.
Potential for service disruption or unauthorized access.
Confirm relevance and exposure to affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable firmware upload feature on D-Link routers without any authentication. This exposure allows them to send malicious data, potentially leading to disruption of the device's services.

No authentication needed to access.
Firmware upload feature is the trigger.
Denial of service is the potential risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the availability of a D-Link router, potentially disrupting network services when accessed through its web interface.

Router availability.
Unspecified vectors.
Denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects D-Link DIR-823G routers and impacts their firmware upload functionality. Ownership likely falls to the network infrastructure or system administration teams responsible for managing these devices. The first practical step is to identify all instances of this hardware, confirm their internet exposure and business criticality, and then assign an owner for remediation planning.

Network or infrastructure teams own this.
Verify internet-facing devices immediately.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-823G and its role in a network?

The D-Link DIR-823G is a wireless router designed for home or small office environments. It acts as the gateway connecting local devices to the internet. The affected software component, specifically the firmware upload function, is a core system feature intended for administrators to update the router's operating code, which manages how the device processes data traffic and maintains network security.

What does CWE-862 mean for CVE-2020-25366?

CWE-862 refers to a 'Missing Authorization' weakness. In the context of this CVE, it means the router's firmware upload interface fails to verify if a user has the proper credentials or permissions before allowing them to interact with the function. Because this check is absent, the system treats unauthorized requests as legitimate, allowing an attacker to interact with a component that should be strictly protected.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious data to the specific /cgi-bin/upload_firmware.cgi path on the device. Because the feature lacks authentication, no valid login or user session is required to initiate this request. Simply browsing to the interface is not the trigger; the attacker must specifically interact with the firmware upload process, which then causes the system to crash or stop functioning as intended.

Is my D-Link router at risk if it is not internet-facing?

Halo Surface Signal indicates that administrative interfaces like this are often reachable over the internet in home and office deployments. If your device is exposed directly to the public web, it is at higher risk. Devices kept on an internal, isolated network face less immediate danger from external actors, though they may still be vulnerable if a malicious actor gains access to your internal local network.

What steps should I take if I use a D-Link DIR-823G?

Your first priority is to locate all instances of this hardware within your environment and determine if they are exposed to the internet. Once identified, evaluate the device's role and criticality to your network operations. You should prioritize restricting access to the web management interface and reach out to the vendor or your infrastructure team to plan for firmware updates or device replacement to mitigate the risk of service disruption.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.