D-Link DSL-2760U Gateway Multiple Parameter Cross-Site Scripting (XSS) Vulnerability (CVE-2013-5223)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2013-5223) is a collection of multiple cross-site scripting (XSS) flaws residing in the web-based management console of the D-Link DSL-2760U Gateway (Rev. E1). The root cause is the lack of proper input validation and output encoding on various parameters processed by administrative CGI scripts. Affected components include NTP configuration, DDNS management, URL filtering, port mapping, SNMP configuration, Samba sharing, and wireless SSID settings.

2. Exploitation Mechanics & Attack Scenario

An authenticated remote attacker can exploit these vulnerabilities by submitting malicious HTML or JavaScript payloads into vulnerable parameters such as smbNetBiosName in samba.cgi or wlSsid in wlcfg.wl. When another administrator navigates to the compromised configuration page, the injected script executes within the context of their browser session. Since this vulnerability is listed in the CISA KEV catalog, it has been actively exploited in the wild, often to recruit devices into botnets or perform unauthorized router configuration changes.

3. Infrastructure & Business Impact

Successful exploitation allows attackers to hijack administrative sessions, steal session cookies, and perform unauthorized actions with administrative privileges. This can lead to critical infrastructure compromise, such as altering DNS settings to redirect internal users to malicious sites, disabling firewall rules, or establishing a foothold for lateral movement within the internal local area network (LAN).