# CVE-2013-5223: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

> CVE-2013-5223: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability. CVSS 5.4 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2013-5223
Last updated: 2025-10-22T00:05:39Z

- Published: 2013-11-15 20:00 UTC · Updated: 2025-10-22 00:05 UTC · Assigner: mitre
- CVSS: 5.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS: 50.8%, 99th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2022-03-25, federal due date 2022-04-15, ransomware use: Unknown

## Description

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- D-Link: DSL-2760U

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2013-5223)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2013-5223)
- [http://osvdb.org/99603](http://osvdb.org/99603)
- [http://osvdb.org/99604](http://osvdb.org/99604)
- [http://osvdb.org/99605](http://osvdb.org/99605)
- [http://osvdb.org/99606](http://osvdb.org/99606)
- [http://osvdb.org/99607](http://osvdb.org/99607)
- [http://osvdb.org/99608](http://osvdb.org/99608)
- [http://osvdb.org/99609](http://osvdb.org/99609)
- [http://osvdb.org/99610](http://osvdb.org/99610)
- [http://osvdb.org/99611](http://osvdb.org/99611)
- [http://osvdb.org/99612](http://osvdb.org/99612)
- [http://osvdb.org/99613](http://osvdb.org/99613)
- [http://osvdb.org/99615](http://osvdb.org/99615)
- [http://osvdb.org/99616](http://osvdb.org/99616)
- [http://packetstormsecurity.com/files/123976](http://packetstormsecurity.com/files/123976)
- [http://seclists.org/fulldisclosure/2013/Nov/76](http://seclists.org/fulldisclosure/2013/Nov/76)
- [http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002](http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/88723](https://exchange.xforce.ibmcloud.com/vulnerabilities/88723)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/88724](https://exchange.xforce.ibmcloud.com/vulnerabilities/88724)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2013-5223 · Markdown: https://rewindex.com/cve/CVE-2013-5223.md · JSON: https://rewindex.com/api/v1/cves/CVE-2013-5223 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:46:22.619Z