Dlink vulnerabilities

CVE-2025-11097 High · 8.8 CWE-74 Sep 28, 2025

D-Link DIR-823X set_device_name command injection

A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-11096 High · 8.8 CWE-74 Sep 28, 2025

D-Link DIR-823X diag_traceroute command injection

A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.

CVE-2025-11095 High · 8.8 CWE-74 Sep 28, 2025

D-Link DIR-823X delete_offline_device command injection

A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVE-2025-11092 High · 8.8 CWE-74 Sep 28, 2025

D-Link DIR-823X set_switch_settings sub_412E7C command injection

A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

CVE-2025-10814 High · 8.8 CWE-74 Sep 22, 2025

D-Link DIR-823X goahead command injection

A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-29635 High · 7.2 KEV High · 60 Public exploit CWE-77 Mar 25, 2025

D-Link DIR-823X Command Injection Vulnerability

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

CVE-2024-3272 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-798 Apr 3, 2024

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2024-3273 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-77 Apr 3, 2024

D-Link Multiple NAS Devices Command Injection Vulnerability

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2024-0769 Critical · 9.8 KEV High · 60 CWE-22 Jan 21, 2024

D-Link DIR-859 Router Path Traversal Vulnerability

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2023-25280 Critical · 9.8 KEV High · 67 Public exploit CWE-78 Mar 15, 2023

D-Link DIR-820 Router OS Command Injection Vulnerability

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

CVE-2022-40799 High · 8.8 KEV High · 56 CWE-494 Nov 29, 2022

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

CVE-2016-20017 Critical · 9.8 KEV Urgent · 75 Public exploit CWE-77 Oct 19, 2022

D-Link DSL-2750B Devices Command Injection Vulnerability

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

CVE-2022-37055 Critical · 9.8 KEV High · 63 CWE-120 Aug 28, 2022

D-Link Routers Buffer Overflow Vulnerability

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

CVE-2022-26258 Critical · 9.8 KEV High · 63 CWE-78 Mar 27, 2022

D-Link DIR-820L Remote Code Execution Vulnerability

D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

CVE-2021-45382 Critical · 9.8 KEV High · 67 Public exploit CWE-78 Feb 17, 2022

D-Link Multiple Routers Remote Code Execution Vulnerability

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

CVE-2021-40655 High · 7.5 KEV High · 60 Public exploit CWE-863 Sep 24, 2021

D-Link DIR-605 Router Information Disclosure Vulnerability

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

CVE-2020-25506 Critical · 9.8 KEV High · 67 Public exploit CWE-78 Feb 2, 2021

D-Link DNS-320 Device Command Injection Vulnerability

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

CVE-2020-29557 Critical · 9.8 KEV High · 63 CWE-119 Jan 29, 2021

D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

CVE-2020-25079 High · 8.8 KEV High · 56 CWE-77 Sep 2, 2020

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

CVE-2020-25078 High · 7.5 KEV High · 69 Public exploit Sep 2, 2020

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

CVE-2020-9377 High · 8.8 KEV High · 56 CWE-78 Jul 9, 2020

D-Link DIR-610 Devices Remote Command Execution

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVE-2016-11021 High · 7.2 KEV High · 68 Public exploit CWE-78 Mar 8, 2020

D-Link DCS-930L Devices OS Command Injection Vulnerability

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

CVE-2019-20500 High · 7.8 KEV High · 64 Public exploit CWE-78 Mar 5, 2020

D-Link DWL-2600AP Access Point Command Injection Vulnerability

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

CVE-2019-17621 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-78 Dec 30, 2019

D-Link DIR-859 Router Command Execution Vulnerability

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

CVE-2019-16920 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 Sep 27, 2019

D-Link Multiple Routers Command Injection Vulnerability

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.