CVE WatchJul 9, 2026

CVE-2022-26258

D-Link DIR-820L Remote Code Execution Vulnerability

CVSS

9.8

Critical

EPSS

81.1%

p100

KEV

YES

Sep 8, 2022

Exploit Today

0-100

Published: Mar 28, 2022 · Last modified: Jul 9, 2026 · CWE-78

EPSS · 30d

81.1%EPSS · 30 days81.2%

2026-06-302026-07-16

KEV catalog record

Product

D-Link / DIR-820L

Vulnerability

D-Link DIR-820L Remote Code Execution Vulnerability

Added to KEV

Sep 8, 2022

Remediate by

Sep 29, 2022

Known ransomware use

Summary description

D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Notes

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10295; https://nvd.nist.gov/vuln/detail/CVE-2022-26258

Technical description

D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2d CVE-2024-121210.0 CRI

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability3d CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability2d CVE-2021-252988.8 HIG

99.5%

KEV—80Nagios XI OS Command Injection7d CVE-2021-252978.8 HIG

98.9%

KEV—80Nagios XI OS Command Injection7d CVE-2023-463599.8 CRI

99.5%

——30An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.8d