How severe is CVE-2013-5223?

CVE-2013-5223 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2013-5223 being actively exploited?

Yes. CVE-2013-5223 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2013-5223?

CVE-2013-5223 affects Dlink Dsl-2760u Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2013-5223?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2013-5223 have an EU (EUVD) identifier?

Yes. CVE-2013-5223 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2013-5063. It is also flagged as exploited in the EUVD (since 2022-03-25).

When was CVE-2013-5223 published?

CVE-2013-5223 was published on 2013-11-19 and last updated on 2026-06-16.

CVE-2013-5223

CVE-2013-5223 is a medium-severity vulnerability in Dlink Dsl-2760u Firmware with a CVSS 3.x base score of 5.4. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-03-25). The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
CVSS v2: 3.5
EPSS exploit prediction: 34% (98th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2022-03-25)
EU (EUVD) id: EUVD-2013-5063
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-03-25)
Weakness: CWE-79
Affected product: Dlink Dsl-2760u Firmware
Published: 2013-11-19
Last modified: 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.

Frequently asked questions

What is CVE-2013-5223?: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
How severe is CVE-2013-5223?: CVE-2013-5223 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2013-5223 being actively exploited?: Yes. CVE-2013-5223 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2013-5223?: CVE-2013-5223 affects Dlink Dsl-2760u Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2013-5223?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2013-5223 have an EU (EUVD) identifier?: Yes. CVE-2013-5223 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2013-5063. It is also flagged as exploited in the EUVD (since 2022-03-25).
When was CVE-2013-5223 published?: CVE-2013-5223 was published on 2013-11-19 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:o:dlink:dsl-2760u_firmware:*:*:*:*:*:*:*:*

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →