CVE-2026-52533

Privilege Escalation via /etc/shadow Manipulation on D-Link DIR-1253

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file

Analysis

AI-generated

Technical impact

An issue in D-Link DIR-1253 routers running firmware version 1.0.1.250923.142435 allows an attacker to modify the /etc/shadow component file and gain higher privileges. The flaw permits elevation of a non-privileged user to administrative rights, enabling full control over the device and potentially the surrounding network.

Affected Systems

The vulnerability impacts the D-Link DIR-1253 model with firmware 1.0.1.250923.142435. No other models or firmware revisions are noted as affected.

Risk and Exploitability

The CVSS score of 9.8 reflects a critical severity, while the EPSS score of <1% suggests a low probability of exploitation in the immediate future. The flaw is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attacker may target the vulnerable /etc/shadow component through remote access such as the router's web interface or via local code that can reach the component, allowing a non-privileged user to obtain full administrative control.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router to the latest D-Link firmware that fixes the /etc/shadow privilege‑escalation issue.
  • Lock down the permissions on /etc/shadow so that it is not writable by users other than root and remove any set‑uid bits.
  • Disable or remove any utilities or web‑interface features that expose the ability to modify the /etc/shadow component if they are not required.

Generated by OpenCVE AI on July 31, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation on D-Link DIR-1253
Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation in D-Link DIR-1253
Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Manipulation in D-Link DIR-1253
Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Component in D‑Link DIR‑1253
Weaknesses CWE-280
CWE-732
Type Values Removed Values Added
Title Privilege Escalation via /etc/shadow Component in D‑Link DIR‑1253
Weaknesses CWE-280
CWE-732
Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-1253
Vendors & Products Dlink
Dlink dir-1253
Type Values Removed Values Added
Description An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
References
Earlier changes (3)
Weaknesses
  • CWE-269

    Improper Privilege Management

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jul 14, 2026, 1:37 PM
Reserved
Jun 8, 2026, 12:00 AM

View source JSON

Updated
Jul 14, 2026, 1:37 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 10:16 PM
Modified
Jul 15, 2026, 8:27 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:30 PM

JSON