Description
An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
Published: 2026-07-13
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An issue in D-Link DIR-1253 routers running firmware version 1.0.1.250923.142435 allows an attacker to modify the /etc/shadow component file and gain higher privileges. The flaw permits elevation of a non-privileged user to administrative rights, enabling full control over the device and potentially the surrounding network.

Affected Systems

The vulnerability impacts the D-Link DIR-1253 model with firmware 1.0.1.250923.142435. No other models or firmware revisions are noted as affected.

Risk and Exploitability

The CVSS score of 9.8 reflects a critical severity, while the EPSS score of <1% suggests a low probability of exploitation in the immediate future. The flaw is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attacker may target the vulnerable /etc/shadow component through remote access such as the router's web interface or via local code that can reach the component, allowing a non-privileged user to obtain full administrative control.

Generated by OpenCVE AI on July 31, 2026 at 12:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest D-Link firmware that fixes the /etc/shadow privilege‑escalation issue.
  • Lock down the permissions on /etc/shadow so that it is not writable by users other than root and remove any set‑uid bits.
  • Disable or remove any utilities or web‑interface features that expose the ability to modify the /etc/shadow component if they are not required.

Generated by OpenCVE AI on July 31, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation on D-Link DIR-1253

Thu, 23 Jul 2026 06:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation in D-Link DIR-1253

Fri, 17 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation in D-Link DIR-1253

Thu, 16 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Component in D‑Link DIR‑1253
Weaknesses CWE-280
CWE-732

Tue, 14 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Component in D‑Link DIR‑1253
Weaknesses CWE-280
CWE-732

Tue, 14 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-1253
Vendors & Products Dlink
Dlink dir-1253

Mon, 13 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
References

Subscriptions

Dlink Dir-1253
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-14T13:37:23.520Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-52533

cve-icon Vulnrichment

Updated: 2026-07-14T13:37:14.524Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:30:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management