CVE-2022-26258Critical· 9.8▾ Hadal⚠ Exploited in the wild

D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score97/ 100 · Severe

impact 53.9 · likelihood 18.3 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 28, 2022

Updated

Jul 5, 2026

CVSS

9.8

Vendor

dlink

Product

dir-820l_firmware

CWE

CWE-78, CWE-78

Depth score

97 · Severe

EPSS

92% · p100

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 31.

80% → 92%▲ 12%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 1624 days

Mar 28, 2022Published
Disclosed via NVD
Sep 8, 2022Added to CISA KEV
Federal remediation due Sep 29, 2022
Jul 5, 2026Record revised
Last analysed / modified upstream
Jul 31, 2026EPSS first tracked
80%
Sep 7, 2026EPSS peak
80% → 92%

dlink CWE-78 CWE-78 #nvd #kev #in-the-wild

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Sep 8, 2022. Federal remediation due Sep 29, 2022. View catalog ↗

Affected

dir-820l_firmware = 1.05b03

Full technical detail▾

Overview

D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

Affected

dir-820l_firmware = 1.05b03

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Sep 7, 2026EPSS 80% → 92%

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild