External risk intelligence

D-Link DIR-823G HNAP1 Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2020-25367

This command injection vulnerability affects the HNAP1 protocol in a D-Link router management interface. Because this interface is designed for administrative access and is network-reachable, it is a high-value target for exploitation. The lack of authentication and public accessibility in standard deployments make it very likely to be targeted by remote attackers.

OS Command Injection

Dlink Dir 823g Firmware

1.0.2b05

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability exists in the HNAP1 protocol of D-Link DIR-823G devices. This flaw allows unauthenticated attackers to execute arbitrary commands on the device by sending specially crafted requests. The potential for widespread impact stems from the network-accessible nature of the vulnerability and the critical severity score, indicating a significant risk if exploited.

Attackers can run any command on affected devices.
Critical flaw impacts network device security.
Confirm relevance and exposure to mitigate risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a command injection flaw in the HNAP1 protocol on D-Link DIR-823G devices. By sending specially crafted input to the Captcha field during the login process, an attacker can execute arbitrary commands on the device, potentially leading to significant compromise.

Network access to the device is required.
Input in the Captcha field can trigger the vulnerability.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the HNAP1 protocol of D-Link DIR-823G devices could allow an attacker to execute arbitrary web scripts. This occurs by sending shell metacharacters within the Captcha field during the login process.

Router command execution.
Remote attackers exploit login Captcha field.
Disruption of device service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The HNAP1 protocol vulnerability in D-Link DIR-823G devices suggests that the platform or infrastructure team responsible for network devices, along with the security team, should take the lead. The first practical step is to identify all instances of the affected D-Link DIR-823G devices across the network, determine their exposure and criticality, and then coordinate with the vendor for an appropriate remediation plan.

Network infrastructure and security teams own this.
Verify device reachability and business criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-823G?

The D-Link DIR-823G is a wireless router model. It utilizes the HNAP1 (Home Network Administration Protocol) to facilitate device management and configuration. Users typically rely on this hardware to manage home or small office network traffic, connectivity, and administrative settings through a web-based interface.

What does CVE-2020-25367 mean by command injection?

This vulnerability falls under the weakness class of Improper Neutralization of Special Elements used in an OS Command, known as CWE-78. Essentially, the device fails to properly filter user-supplied input. This allows an attacker to insert unauthorized system commands into the login form that the router then executes with administrative privileges.

How is this command injection triggered?

The vulnerability is triggered by injecting specific shell metacharacters into the Captcha field during the router's login process. Notably, the vulnerability requires interaction with this specific input field; standard navigation or legitimate administrative actions that do not involve submitting malicious character sequences to the Captcha interface do not trigger the bug.

Is my D-Link DIR-823G at risk?

According to Halo Surface Signal, this vulnerability is classified as external because it targets a network-reachable management interface. If your device is configured to be accessible from the internet, it is considered very likely to be targeted by remote attackers. Internal-only devices are less exposed, though they remain vulnerable if an attacker gains access to your local network.

What steps should I take if I use this router?

First, locate all D-Link DIR-823G units within your network environment to assess which are currently in use. Once identified, verify their network reachability and determine if they are exposed to the public internet. Prioritize restricting access to these management interfaces while you coordinate with D-Link to identify and apply the correct firmware updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.