Is CVE-2013-5223 actively exploited?

Yes. CVE-2013-5223 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2013-5223 be exploited remotely?

The attack vector of CVE-2013-5223 has not been classified yet.

What is the CVSS score of CVE-2013-5223?

CVE-2013-5223 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2013-5223

HIGHCISA KEVIN THE WILD

CVE-2013-5223

Published: March 25, 2022

EPSS:35.46%probability of exploitation in 30 daysPercentile:97.0th

Official Description

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

NVD Source

CISA KEV Advisory

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

Added to KEV: 2022-03-25Federal patch deadline: 2022-04-15

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

The D-Link DSL-2760U gateway has a cross-site scripting (XSS) vulnerability, enabling authenticated remote attackers to inject malicious web scripts or HTML. With a high EPSS score of 0.35461 and confirmed exploitation, this vulnerability poses a significant risk to user sessions and data integrity.

This vulnerability has been actively exploited in the wild and is listed in CISA's KEV catalog, indicating confirmed real-world exploitation. Exploitation requires prior authentication.

Recommended Action

Update the D-Link DSL-2760U gateway firmware to the latest secure version. Implement strong input validation and output encoding practices for web applications.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2013-5223 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2013-5223 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.