[ Vendor · 34 CVEs ]
D-Link
CVEs affecting D-Link published in the last 30 days, plus any D-Link CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113736 | 21 Oct 2026 | CVSS 9.8 | D-Link DHP-W610AVA vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file… | |
| CVE-2026-113735 | 21 Oct 2026 | CVSS 3.7 | D-Link DCS-6501LHA vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file… | |
| CVE-2026-112146 | 19 Oct 2026 | CVSS 7.4 | D-Link E15A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the… | |
| CVE-2026-110536 | 14 Oct 2026 | CVSS 10.0 | D-Link DIR-868LA vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI… | |
| CVE-2026-108971 | 13 Oct 2026 | CVSS 9.6 | D-Link DCS-930LA flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency… | |
| CVE-2026-101081 | 28 Sep 2026 | CVSS 9.1 | D-Link DI-8400A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp… | |
| CVE-2026-100740 | 27 Sep 2026 | CVSS 9.9 | D-Link DIR-895LA vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP… | |
| CVE-2026-96891 | 24 Sep 2026 | CVSS 9.8 | D-Link DIR-825A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp… | |
| CVE-2025-29635 | 25 Mar 2025 | CVSS 7.2 | D-Link DIR-823X Command InjectionA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices… | Exploited |
| CVE-2024-3272 | 4 Apr 2024 | CVSS 9.8 | D-Link Multiple NAS Devices Use of Hard-Coded Credentials** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and… | Exploited |
| CVE-2024-3273 | 4 Apr 2024 | CVSS 9.8 | D-Link Multiple NAS Devices Command Injection** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to… | Exploited |
| CVE-2024-0769 | 21 Jan 2024 | CVSS 9.8 | D-Link DIR-859 Router Path Traversal** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some… | Exploited |
| CVE-2023-25280 | 16 Mar 2023 | CVSS 9.8 | D-Link DIR-820 Router OS Command InjectionOS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the… | Exploited |
| CVE-2022-40799 | 29 Nov 2022 | CVSS 8.8 | D-Link DNR-322L Download of Code Without Integrity CheckData Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. | Exploited |
| CVE-2016-20017 | 19 Oct 2022 | CVSS 9.8 | D-Link DSL-2750B Devices Command InjectionD-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016… | ExploitedFix |
| CVE-2022-37055 | 28 Aug 2022 | CVSS 9.8 | D-Link Routers Buffer OverflowD-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main, | ExploitedFix |
| CVE-2022-26258 | 28 Mar 2022 | CVSS 9.8 | D-Link DIR-820L Remote Code ExecutionD-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. | Exploited |
| CVE-2021-45382 | 17 Feb 2022 | CVSS 9.8 | D-Link Multiple Routers Remote Code ExecutionA Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L… | Exploited |
| CVE-2021-40655 | 24 Sep 2021 | CVSS 7.5 | D-Link DIR-605 Router Information DisclosureAn informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a… | Exploited |
| CVE-2020-25506 | 2 Feb 2021 | CVSS 9.8 | D-Link DNS-320 Device Command InjectionD-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code… | Exploited |
| CVE-2020-29557 | 29 Jan 2021 | CVSS 9.8 | D-Link DIR-825 R1 Devices Buffer OverflowAn issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to… | Exploited |
| CVE-2020-25078 | 2 Sep 2020 | CVSS 7.5 | D-Link DCS-2530L and DCS-2670L Devices UnspecifiedAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint… | ExploitedFix |
| CVE-2020-25079 | 2 Sep 2020 | CVSS 8.8 | D-Link DCS-2530L and DCS-2670L Command InjectionAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated… | ExploitedFix |
| CVE-2020-9377 | 9 Jul 2020 | CVSS 8.8 | D-Link DIR-610 Devices Remote Command ExecutionD-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are… | ExploitedFix |
| CVE-2016-11021 | 9 Mar 2020 | CVSS 7.2 | D-Link DCS-930L Devices OS Command InjectionsetSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. | Exploited |
| CVE-2019-20500 | 5 Mar 2020 | CVSS 7.8 | D-Link DWL-2600AP Access Point Command InjectionD-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web… | ExploitedFix |
| CVE-2019-17621 | 30 Dec 2019 | CVSS 9.8 | D-Link DIR-859 Router Command ExecutionThe UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute… | ExploitedFix |
| CVE-2019-16920 | 27 Sep 2019 | CVSS 9.8 | D-Link Multiple Routers Command InjectionUnauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker… | Exploited |
| CVE-2019-16057 | 16 Sep 2019 | CVSS 9.8 | D-Link DNS-320 Remote Code ExecutionThe login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. | Exploited |
| CVE-2018-6530 | 6 Mar 2018 | CVSS 9.8 | D-Link Multiple Routers OS Command InjectionOS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous… | Exploited |
| CVE-2015-2051 | 23 Feb 2015 | CVSS 8.8 | D-Link DIR-645 Router Remote Code ExecutionThe D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a… | Exploited |
| CVE-2014-100005 | 13 Jan 2015 | CVSS 8.0 | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF)Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to… | ExploitedFix |
| CVE-2013-5223 | 19 Nov 2013 | CVSS 5.4 | D-Link DSL-2760U Gateway Cross-Site ScriptingMultiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web… | Exploited |
| CVE-2011-4723 | 20 Dec 2011 | CVSS 5.7 | D-Link DIR-300 Router Cleartext Storage of a PasswordThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified… | Exploited |